114 matches found
CVE-2010-3065: Undefined Security Weakness
The default session serializer in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 does not properly handle the PSUNDEFMARKER marker, which allows context-dependent attackers to modify arbitrary session variables via a crafted session variable name...
CVE-2007-5795: Undefined Security Weakness
The hack-local-variables function in Emacs before 22.2, when enable-local-variables is set to :safe, does not properly search lists of unsafe or risky variables, which might allow user-assisted attackers to bypass intended restrictions and modify critical program variables via a file containing a...
CVE-2007-2036
CVE-2007-2036 refers to a vulnerability in the Cisco Wireless LAN Controller (WLC) where the SNMP implementation (pre-20070419) uses default read-only public and read-write private communities. This allows remote attackers to read and modify SNMP variables, potentially gaining full access to SNMP...
CVE-2007-1343: Undefined Security Weakness
includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet variable from external modification, which allows remote attackers to set arbitrary global variables via a URL with modified values in the noSet parameter, which leads to resultant vulnerabilities that...
CVE-2007-0930: Undefined Security Weakness
Variable extract vulnerability in Apache Stats before 0.0.3beta allows attackers to modify arbitrary variables and conduct attacks via unknown vectors involving the use of PHP's extract function...
CVE-2006-2158
Dynamic variable evaluation vulnerability in index.php in Stadtaus Guestbook Script 1.7 and earlier, when registerglobals is enabled, allows remote attackers to modify arbitrary program variables via parameters, which are evaluated as PHP variable variables, as demonstrated by performing PHP remo...
CVE-2006-0724: Undefined Security Weakness
profile.php in Reamday Enterprises Magic News Lite 1.2.3, when registerglobals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified 1 action, 2 passwd, 3 adminpassword, 4 newpasswd, and 5 confirmpasswd variables, which are not...
CVE-2006-0636: Undefined Security Weakness
desktop.php in eyeOS 0.8.9 and earlier tests for the existence of the SESSION variable before calling the sessionstart function, which allows remote attackers to execute arbitrary PHP code and possibly conduct other attacks by modifying critical assumed-immutable variables, as demonstrated using...
Multiple PHP vulnerabilities
phpinfo crossite scripting, parsestr registerglobals activisation possibility, $GLOBALS variable modification witrh HTTP POST form 'fileupload' field. It's also possible to modify any variable with GLOBALSvariable...
CVE-2005-2574
xmb.php in XMB Forum 1.9.1 extracts and defines all provided variables, which allows remote attackers to modify arbitrary server variables such as SERVERREMOTEADDR...
CVE-2005-2574: Undefined Security Weakness
xmb.php in XMB Forum 1.9.1 extracts and defines all provided variables, which allows remote attackers to modify arbitrary server variables such as SERVERREMOTEADDR...
CVE-2005-2482: Undefined Security Weakness
The StateToOptions function in msfweb in Metasploit Framework 2.4 and earlier, when running with the -D option defanged mode, allows attackers to modify temporary environment variables before the "Defanged" environment option is checked when processing the Exploit command...