Joomla 1.5.12 TinyBrowser File Upload Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Joomla 1.5.12...

CVE-2008-7167: Undefined Security Weakness

Unrestricted file upload vulnerability in upload.php in Page Manager 2006-02-04 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory...

CVE-2008-7088: Improper Input Validation

Unrestricted file upload vulnerability in upload.php in PhotoPost vBGallery 2.4.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in a certain path. NOTE:...

TinyBrowser Multiple XSS

TinyBrowser, an open source web file browser, is running on the remote host. TinyBrowser is typically bundled with web applications, such as TinyMCE WYSIWYG content editor or the Joomla! content management system, although it can also be used in its standalone configuration or integrated with oth...

CVE-2009-2156: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to inject arbitrary web script or HTML via 1 the Title field to requests.php, related to viewrequests.php; and 2 the Torrent Name field to torrents-upload.php, related to the logging o...

ZaoCMS (PhpCommander) - Arbitrary File Upload

ZaoCMS PhpCommander - Arbitrary File Upload || || | || o,7 || . o7 || q||| ow, : / / . =By: Qabandi =Email: iqaahotmail.fr From Kuwait PEACE =Vuln: ZaoCMS PhpCommander - Arbitrary File Upload =INFO: http://zaocms.com/ =BUY: http://zaocms.com/ =DORK: --...

Unrestricted file upload

Unrestricted file upload vulnerability in upload.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file...

CVE-2008-6769: Undefined Security Weakness

Unrestricted file upload vulnerability in upload.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file...

CVE-2009-1446: Improper Input Validation

Unrestricted file upload vulnerability in upload.php in Elkagroup Image Gallery 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in gallery/pictures/. NOTE: some of these details ar...

CVE-2008-6617: Undefined Security Weakness

Unrestricted file upload vulnerability in adm/visual/upload.php in SiteXS CMS 0.1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/...

CVE-2009-1090

Directory traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the uploaded parameter...

CVE-2009-1089

CVE-2009-1089 describes an absolute path traversal in Rapidleech (rev.36 and earlier) where a base64-encoded absolute path supplied in the filename parameter to upload.php allows remote attackers to read arbitrary files. The CVE is documented with a Medium (5.0) severity per NVD; however, the pro...

CVE-2009-1091

CVE-2009-1091 : Cross-site scripting (XSS) vulnerability in upload.php of Rapidleech rev.36 and earlier. Remote attackers can inject arbitrary web script or HTML via the uploaded parameter. Affected: Rapidleech upload.php (rev.36 and earlier). Impact: partial integrity; no confidentiality or avai...

CVE-2009-1089: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to read arbitrary files via a base64-encoded absolute path in the filename parameter...

CVE-2009-1090: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the uploaded parameter...

CVE-2009-1091: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to inject arbitrary web script or HTML via the uploaded parameter...

CVE-2009-0602: Improper Input Validation

Unrestricted file upload vulnerability in upload.php in WikkiTikkiTavi 1.11 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in img/...

CVE-2008-6118: Improper Authentication

win/content/upload.php in Goople CMS 1.7 allows remote attackers to bypass authentication and gain administrative access by setting the loggedin cookie to 1...

WikkiTikkiTavi 'upload.php'任意文件上传漏洞

BUGTRAQ ID: 33647 CNCAN ID：CNCAN-2009020702 WikkiTikkiTavi是一款Wiki引擎。 WikkiTikkiTavi 'upload.php'脚本存在漏洞，远程攻击者可以利用漏洞上传任意PHP文件。 攻击者通过上传恶意PHP文件，可导致以WEB权限执行任意命令。 WikkiTikkiTavi 1.11 厂商解决方案 目前供应商没有提供补丁信息： http://tavi.sourceforge.net/...

Directory traversal

Directory traversal vulnerability in upload.php in Phlatline's Personal Information Manager pPIM 1.0 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter within a delfile action...