EUVD-2006-2701

Malware in sbrugna...

CVE-2008-6315

PHP remote file inclusion vulnerability in conf/core/common-tpl-vars.php in PHPmyGallery 1.0 beta2 allows remote attackers to execute arbitrary PHP code via a URL in the confdir parameter, a different issue than CVE-2008-6316...

CVE-2008-6318: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in conf/php-core/common-tpl-vars.php in PHPmyGallery 1.5 beta allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter, a different vector than CVE-2008-6317...

CVE-2008-6317: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in conf/php-core/common-tpl-vars.php in PHPmyGallery 1.5 beta allows remote attackers to include and execute arbitrary local files via a .. dot dot in the conflang parameter, a different issue than CVE-2008-6318. NOTE: this might be the same issue as CVE-2008-631...

PHPmyGallery 1.5beta (common-tpl-vars.php) LFI/RFI Vulnerabilities

Exploit for unknown platform in category web applications ================================================================== PHPmyGallery 1.5beta common-tpl-vars.php LFI/RFI Vulnerabilities ================================================================== Phpmygallery-1.5beta common-tpl-vars.php...

DEBIAN-CVE-2008-2146

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATHINFO $PHPSELF, which allows remote attackers to bypass intended access restrictions for certain pages...

Design/Logic Flaw

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATHINFO $PHPSELF, which allows remote attackers to bypass intended access restrictions for certain pages...

CVE-2008-2146

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATHINFO $PHPSELF, which allows remote attackers to bypass intended access restrictions for certain pages...

CVE-2008-2146: Undefined Security Weakness

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATHINFO $PHPSELF, which allows remote attackers to bypass intended access restrictions for certain pages...

CVE-2007-6658

CVE-2007-6658 concerns a SQL injection in the CustomCMS (CCMS) 3.1 Demo, specifically in the files/admin.php/vars.php. The underlying issue is an injection vulnerability exploitable via the p parameter on the Console page, enabling remote attackers to execute arbitrary SQL commands. The available...

CVE-2007-6658: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin.php/vars.php in CustomCMS CCMS 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page...

CVE-2007-2149: Undefined Security Weakness

Stephen Craton aka WiredPHP Chatness 2.5.3 and earlier stores usernames and unencrypted passwords in 1 classes/vars.php and 2 classes/varstuff.php, and recommends 0666 or 0777 permissions for these files, which allows local users to gain privileges by reading the files, and allows remote attacker...

CVE-2007-1622: Undefined Security Weakness

Cross-site scripting XSS vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATHINFO in the administration interface, related to loose...

CVE-2006-2702

vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PCREMOTEADDR HTTP header, which vars.php uses to redefine $SERVER'REMOTEADDR'...

CVE-2006-2702

CVE-2006-2702 : WordPress 2.0.2 contains a vulnerability where vars.php may redefine $_SERVER['REMOTE_ADDR'] using the PC_REMOTE_ADDR HTTP header, allowing remote IP spoofing (noted on Mac OS X). The issue is supported by connected advisories indicating remediation through upgrading to WordPress ...

CVE-2006-2702

vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PCREMOTEADDR HTTP header, which vars.php uses to redefine $SERVER'REMOTEADDR'...

CVE-2006-2702: Undefined Security Weakness

vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PCREMOTEADDR HTTP header, which vars.php uses to redefine $SERVER'REMOTEADDR'...

WordPress <= 2.0.2 - Shell Injection

Because of this vulnerability in vars.php, the attackers can spoof their IP address via a PCREMOTEADDR HTTP header and include a remote file. Solution Update the WordPress to the latest available version at least 2.0.3...

CVE-2005-4463: Undefined Security Weakness

WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to 1 wp-includes/vars.php, 2 wp-content/plugins/hello.php, 3 wp-admin/upgrade-functions.php, 4 wp-admin/edit-form.php, 5 wp-settings.php, and 6 wp-admin/edit-form-comment.php, which leaks the path ...