8551 matches found
CVE-2007-1726
Unrestricted file upload vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to upload arbitrary files via the avatar function, which can later be accessed in uploads/...
CVE-2007-1119
Unspecified vulnerability in Novell ZENworks 7 Desktop Management Support Pack 1 before Hot patch 3 ZDM7SP1HP3 allows remote attackers to upload images to certain folders that were not configured in the "Only allow uploads to the following directories" setting via unspecified vectors...
CVE-2007-1119
CVE-2007-1119 affects Novell ZENworks 7 Desktop Management Support Pack 1 prior to Hot patch 3 (ZDM7SP1HP3). The issue allows remote attackers to upload images to certain folders that were not configured in the “Only allow uploads to the following directories” setting, via unspecified vectors. Pu...
CVE-2007-0147
Cuyahoga before 1.0.1 installs the FCKEditor component with an incorrect deny statement in a Web.config file, which allows remote attackers to upload files when these privileges were intended only for the Administrator and Editor roles...
Design/Logic Flaw
Cuyahoga before 1.0.1 installs the FCKEditor component with an incorrect deny statement in a Web.config file, which allows remote attackers to upload files when these privileges were intended only for the Administrator and Editor roles...
CVE-2007-0147
Cuyahoga before 1.0.1 installs the FCKEditor component with an incorrect deny statement in a Web.config file, which allows remote attackers to upload files when these privileges were intended only for the Administrator and Editor roles...
CVE-2007-0082
usersadm/start1.php in IMGallery 2.5 and earlier does not properly handle files with multiple extensions, which allows remote authenticated users to upload and execute arbitrary PHP scripts...
contentnow-130-2.txt
ContentNow Directory Traversalupload.php ------------------------------------------ -vulnerability By: Timq -http://securitydb.org -Team Root-Shell -Email:timqathushmail.com ------------------------------------------ It appears that it is possible to view any files on a system via 'upload.php'...
ContentNow 1.30 (upload/xss) Multiple Remote Vulnerabilities
No description provided by source. ContentNow Directory Traversalupload.php ------------------------------------------ -vulnerability By: Timq -http://securitydb.org -Team Root-Shell -Email:timqathushmail.com ------------------------------------------ It appears that it is possible to view any...
CVE-2006-5833
gbcmsphpfiles/uploader.php GreenBeast CMS 1.3 does not require authentication to upload files, which allows remote attackers to cause a denial of service disk consumption and execute arbitrary code by uploading arbitrary files, such as executing PHP code via an uploaded PHP file...
PT-2006-5351 · Deluxebb +1 · Deluxebb +1
Name of the Vulnerable Software and Affected Versions: DeluxeBB versions 1.06 and earlier Description: The issue allows remote attackers to execute arbitrary PHP code by uploading files with double extensions via the fileupload parameter in a newthread action in newpost.php, specifically when run...
PmWiki < 2.1.21 Global Variables Overwriting
The version of PmWiki installed on the remote host contains a programming flaw in 'pmwiki.php' that may allow an unauthenticated remote attacker to overwrite global variables used by the application, which could in turn be exploited to execute arbitrary PHP code on the affected host, subject to t...
Awareness of vulnerabilities haha-vulnerability warning-the black bar safety net
Text/SuperHeiAtph4nt0m.org 2006-2-12 2006-02-0 9, milw0rm released the FCKEditor one upload vulnerability1. Fig. FCKEditor is one of a plurality of language Language version of theasp,cgi,aspx,php,cfm,...of the online editing class2, many web systems use this A class. In fact, this is something o...
CVE-2006-3935
system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to 1 send broadcast messages to all users /workplace/broadcast, 2 list all users /accounts/users, 3 add webusers...
MyBulletinBoard (MyBB) 1.x - 'usercp.php' Directory Traversal
source: https://www.securityfocus.com/bid/19195/info MyBulletinBoard is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the...
flatnuke <= 2.5.7 arbitrary php file upload
12/07/200619.11.54 ----- Flatnuke 2.5.7 arbitrary file upload / remote code execution ------------- software: site: http://www.flatnuke.org/ -------------------------------------------------------------------------------- if user Gallery uploads are enabled not the default you can go to:...
Microsoft Internet Explorer 5.56.07.0 - JavaScript Key Filtering
Microsoft Internet Explorer 5.56.07.0 - JavaScript Key Filtering source: https://www.securityfocus.com/bid/18308/info Multiple web browsers are prone to a JavaScript key-filtering vulnerability because the browsers fail to securely handle keystroke input from users. This issue is demonstrated to...
FreeBSD : coppermine -- Multiple File Extensions Vulnerability (0b628470-e9a6-11da-b9f4-00123ffe8333)
Secunia reports : Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious users to compromise a vulnerable system. The vulnerability is caused due to an error in the handling of file uploads where a filename has multiple file extensions. This can be exploited to upload...
coppermine -- Multiple File Extensions Vulnerability
Secunia reports: Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious users to compromise a vulnerable system. The vulnerability is caused due to an error in the handling of file uploads where a filename has multiple file extensions. This can be exploited to upload...
PT-2006-3389 · Dubanner · Dubanner
Name of the Vulnerable Software and Affected Versions: DUbanner version 3.1 Description: The issue allows remote attackers to execute arbitrary code by uploading files with arbitrary extensions, such as ASP files, to the add.asp endpoint, probably due to client-side enforcement that can be...