Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
://secunia.com/advisories/21208 - http://www.securityfocus.com/bid/19157 - http://securitytracker.com/id?1016593 - http://www.securityfocus.com/archive/1/441202/100/0/threaded - https://www.exploit-db.com/exploits/2072 - http://www.osvdb.org/27543 - http://www.etomite.org/forums/index.php?showtopic=5757&st=0&p=35605&#entry35605 - http://retrogod.altervista.org/etomite_061_cmd.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27947 - http://securityreason.com/securityalert/2326
CVE ID: CVE-2006-7071 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:06.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in classes/class_session.php in Invision Power Board (IPB) 2.1 up to 2.1.6 allows remote attackers to execute arbitrary SQL commands via the CLIENT_IP parameter. Additional Analyst Notes: - CVE Program Container: References: - http://rst.void.ru/download/r57ipb216gui.txt - http://archives.neohapsis.com/archives/bugtraq/2006-07/0249.html - http://secunia.com/advisories/21072 - http://www.vupen.com/english/advisories/2006/2810 - https://www.exploit-db.com/exploits/2010 - https://exchange.xforce.ibmclo
//www.vupen.com/english/advisories/2006/2810 - https://www.exploit-db.com/exploits/2010 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27753 - http://securityreason.com/securityalert/2325
CVE ID: CVE-2006-7072 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:06.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in GeoClassifieds Enterprise 2.0.5.2 and earlier allows remote attackers to inject arbitrary web script and HTML via the (1) b[username] and (2) c parameters to (a) index.php, the b[username] parameter to (b) admin/index.php, and (3) c[phone] parameter to register.php. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/2324 - http://www.osvdb.org/27632 - http://www.osvdb.org/27630 - https://exchange.xforce.ibmcloud.com/vulnerabilitie
ert/2324 - http://www.osvdb.org/27632 - http://www.osvdb.org/27630 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28041 - http://www.vupen.com/english/advisories/2006/3065 - http://www.osvdb.org/27631 - http://www.securityfocus.com/bid/19196 - http://www.securityfocus.com/archive/1/441294/100/0/threaded - http://secunia.com/advisories/21237
CVE ID: CVE-2006-7073 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:05.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Opentools Attachment Mod before 2.4.5 allows remote attackers to inject arbitrary web script or HTML in Internet Explorer via unknown vectors related to the uploaded attachments form. NOTE: some details were obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/21787 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28788 - http://www.vupen.com/english/advisories/2006/3499 - http://sourceforge.net/pr
force.ibmcloud.com/vulnerabilities/28788 - http://www.vupen.com/english/advisories/2006/3499 - http://sourceforge.net/project/shownotes.php?group_id=66311&release_id=445469 - http://www.securityfocus.com/bid/19888
CVE ID: CVE-2006-7074 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:05.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin.php in SmartSiteCMS 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the userName cookie. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/20769 - http://marc.info/?l=full-disclosure&m=115510147417471&w=2 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28299 - http://www.securityfocus.com/bid/19434
CVE ID: CVE-2006-7075 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:05.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the meta_read_flac function in meta_decoder.c for Aqualung 0.9beta5 and earlier, and CVS 0.193.2 and earlier, allows user-assisted attackers to execute arbitrary code via a long Vorbis comment in a Free Lossless Audio Codec (FLAC) file. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.altervista.org/adv/aquabof-adv.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/28310
CVE ID: CVE-2006-7076 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:06.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB allows remote attackers to inject arbitrary web script or HTML via the entry parameter. NOTE: this issue might be resultant from SQL injection. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/2323 - http://www.majorsecurity.de/advisory/major_rls25.txt - http://archives.neohapsis.com/archives/bugtraq/2006-07/0381.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27907 -
archives.neohapsis.com/archives/bugtraq/2006-07/0381.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27907 - http://secunia.com/advisories/19905
CVE ID: CVE-2006-7077 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:06.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB allows remote attackers to execute arbitrary SQl commands via the entry parameter. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/2323 - http://www.majorsecurity.de/advisory/major_rls25.txt - http://archives.neohapsis.com/archives/bugtraq/2006-07/0381.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27908 - http://secunia.com/advisories/19905
CVE ID: CVE-2006-7078 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:06.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Professional Home Page Tools Login Script, as of July 2006, allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) vorname, and (3) nachname parameters in the register script. NOTE: some details have been obtained from third party sources. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/2981 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27967 - http://secunia.com/advisories/
glish/advisories/2006/2981 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27967 - http://secunia.com/advisories/21206 - http://securityreason.com/securityalert/2329 - http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048194.html - http://www.securityfocus.com/archive/1/441194/100/0/threaded
CVE ID: CVE-2006-7079 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:06.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduct directory traversal attacks to execute arbitrary code by modifying the $xoopsOption['pagetype'] variable. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/2415 - http://www.securityfocus.com/bid/20161 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29116
CVE ID: CVE-2006-7080 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:05.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the old_avatar parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/2415 - http://www.securityfocus.com/bid/20161 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29130
CVE ID: CVE-2006-7081 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:06.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in PhpNews 1.0 allow remote attackers to execute arbitrary PHP code via the Include parameter to (1) Include/lib.inc.php3 and (2) Include/variables.php3. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/28805 - https://www.exploit-db.com/exploits/2323 - http://www.iss.net/security_center/static/10456.php - http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2002-10/0338.html - http://www.securityfocu
tic/10456.php - http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2002-10/0338.html - http://www.securityfocus.com/bid/19904
CVE ID: CVE-2006-7082 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:05.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to bypass authentication and upload arbitrary files via direct requests to (1) adm/photos/images.php and (2) adm/down/files.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/28637 - http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048006.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27873 - http://www.osvdb.org/28638 - http://securityreason.com/securityalert/2322
CVE ID: CVE-2006-7083 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:05.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in index.php in Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to read arbitrary files via ".." sequences in the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048006.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27876 - http://securityreason.com/securityalert/2322 - http://www.osvdb.org/28639
CVE ID: CVE-2006-7084 State: REJECTED Published: 2007-02-27T18:00:00 Last Updated: 2007-08-22T09:00:00 Description: No description available.
CVE ID: CVE-2006-7085 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:06.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to add arbitrary content and conduct XSS attacks via a direct request to add_art.php. NOTE: this issue was originally reported as SQL injection, but this is not likely. Additional Analyst Notes: - CVE Program Container: References: - http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048006.html - http://www.osvdb.org/28640 - https://exchange.xforce.ibmcloud.com/vulnerabilities/39972 - http://securityreason.com/securityalert/2322
CVE ID: CVE-2006-7086 State: PUBLISHED Published: 2007-02-28T00:00:00 Last Updated: 2024-08-07T20:50:06.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) dlback.php and (2) dlback.cgi scripts in Hot Links allow remote attackers to obtain sensitive information and download the database via a direct request with a modified dl parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/30340 - http://secunia.com/advisories/22970 - http://marc.info/?l=bugtraq&m=116373064308228&w=2 - http://www.securityfocus.com/bid/21112 - http://www.vupen.com/english/advisories/2006/4585 - http://marc.info/?l=bugtraq&m=11
//www.securityfocus.com/bid/21112 - http://www.vupen.com/english/advisories/2006/4585 - http://marc.info/?l=bugtraq&m=116370290529916&w=2
CVE ID: CVE-2006-7087 State: PUBLISHED Published: 2007-02-28T00:00:00 Last Updated: 2024-08-07T20:50:06.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in the mail function in Dotdeb PHP before 5.2.0 Rev 3 allows remote attackers to bypass the protection scheme and inject arbitrary email headers via CRLF sequences in the query string, which is processed via the PHP_SELF variable. Additional Analyst Notes: - CVE Program Container: References: - http://www.hardened-php.net/advisory_142006.139.html - http://www.securityfocus.com/archive/1/451528/100/0/threaded - http://www.securityfocus.com/archive/1/451839/100/0/threaded - http://www.vupen.com/engli
hive/1/451528/100/0/threaded - http://www.securityfocus.com/archive/1/451839/100/0/threaded - http://www.vupen.com/english/advisories/2006/4531 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30251 - http://www.dotdeb.org/news/severe_security_hole_in_php_packages - http://secunia.com/advisories/22877 - http://www.securityfocus.com/bid/21075 - http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050712.html
CVE ID: CVE-2006-7088 State: PUBLISHED Published: 2007-02-28T00:00:00 Last Updated: 2024-08-07T20:50:06.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Simple PHP Forum before 0.4 allow remote attackers to execute arbitrary SQL commands via the username parameter to (1) logon_user.php and (2) update_profile.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/4496 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30252 - http://sourceforge.net/project/shownotes.php?release_id=462654
CVE ID: CVE-2006-7089 State: PUBLISHED Published: 2007-02-28T00:00:00 Last Updated: 2024-08-07T20:50:06.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in connexion.php in Ban 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/29863 - http://marc.info/?l=bugtraq&m=116205673106780&w=2
CVE ID: CVE-2006-7090 State: PUBLISHED Published: 2007-02-28T00:00:00 Last Updated: 2024-08-07T20:50:06.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in phpbb_security.php in phpBB Security 1.0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the php_root_path parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/20518 - http://securityreason.com/securityalert/2327 - http://www.securityfocus.com/archive/1/448607 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29573
CVE ID: CVE-2006-7091 State: PUBLISHED Published: 2007-02-28T00:00:00Z Last Updated: 2024-09-16T17:44:01.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in config.php in phpht Topsites FREE 1.022b allows remote attackers to execute arbitrary PHP code via a URL in the fullpath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/20486
CVE ID: CVE-2006-7092 State: PUBLISHED Published: 2007-02-28T00:00:00 Last Updated: 2024-08-07T20:50:06.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in includes/mambo.php in Mambo LaiThai 4.5.4 SP2 and earlier allows remote attackers to execute arbitrary SQL commands via the usercookie[password] cookie parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/20413 - http://www.vupen.com/english/advisories/2006/3953 - http://secunia.com/advisories/22263 - http://mamboxchange.com/forum/forum.php?forum_id=7767
CVE ID: CVE-2006-7093 State: PUBLISHED Published: 2007-02-28T00:00:00 Last Updated: 2024-08-07T20:50:05.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Mambo LaiThai 4.5.4 Security Patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/20458/info - http://www.vupen.com/english/advisories/2006/3953 - http://secunia.com/advisories/22263 - http://mamboxchange.com/forum/forum.php?forum_id=7767
CVE ID: CVE-2006-7094 State: PUBLISHED Published: 2007-02-28T15:00:00 Last Updated: 2024-08-07T20:50:06.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: ftpd, as used by Gentoo and Debian Linux, sets the gid to the effective uid instead of the effective group id before executing /bin/ls, which allows remote authenticated users to list arbitrary directories with the privileges of gid 0 and possibly enable additional attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/34242 - http://www.securityfocus.com/archive/1/460742/100/0/threaded - http://securityreason.com/securityalert/2330 - http://bugs.debian.org/384454 - http://packages.qa
60742/100/0/threaded - http://securityreason.com/securityalert/2330 - http://bugs.debian.org/384454 - http://packages.qa.debian.org/l/linux-ftpd/news/20061125T181702Z.html - http://bugs.gentoo.org/show_bug.cgi?id=155317
CVE ID: CVE-2006-7095 State: PUBLISHED Published: 2007-03-02T19:00:00 Last Updated: 2024-08-07T20:50:06.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer signedness error in the network_receive_packet function in socket.c in dimension 3 engine (dim3) 1.5 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large data_len value, which is cast to a signed short and results in a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.altervista.org/adv/dim3bof-adv.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/26082
CVE ID: CVE-2006-7096 State: PUBLISHED Published: 2007-03-02T19:00:00 Last Updated: 2024-08-07T20:50:06.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the network_host_handle_join function in host.c in dimension 3 engine (dim3) 1.5 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long nickname. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.altervista.org/adv/dim3bof-adv.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/26085
CVE ID: CVE-2006-7097 State: PUBLISHED Published: 2007-03-02T19:00:00Z Last Updated: 2024-09-17T02:06:37.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in TaskFreak! before 0.1.4 have unknown impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.taskfreak.com/versions.html
CVE ID: CVE-2006-7098 State: PUBLISHED Published: 2007-03-03T19:00:00 Last Updated: 2024-08-07T20:50:06.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Debian GNU/Linux 033_-F_NO_SETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0579.html - http://www.securityfocus.com/bid/22732 - https://exchange.xforce.ibmcloud.com/vulnerabilities/32708 - http://osv
.html - http://www.securityfocus.com/bid/22732 - https://exchange.xforce.ibmcloud.com/vulnerabilities/32708 - http://osvdb.org/33816 - http://secunia.com/advisories/24324 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=357561
CVE ID: CVE-2006-7099 State: PUBLISHED Published: 2007-03-03T19:00:00 Last Updated: 2024-08-07T20:50:06.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in index.php in SolarPay allows remote attackers to read certain files via a .. (dot dot) in the read parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/22722 - http://osvdb.org/34693
CVE ID: CVE-2006-7100 State: PUBLISHED Published: 2007-03-03T21:00:00 Last Updated: 2024-08-07T20:50:06.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Insert User 0.1.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/448542/100/0/threaded - https://www.exploit-db.com/exploits/2525 - http://www.securityfocus.com/bid/20493 - http://securityreason.com/securityalert/2331
CVE ID: CVE-2006-7101 State: PUBLISHED Published: 2007-03-03T21:00:00 Last Updated: 2024-08-07T20:50:06.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in admin.php in PHPWind 5.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the AdminUser cookie. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/4462 - http://secunia.com/advisories/22846 - https://www.exploit-db.com/exploits/2759 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30184
CVE ID: CVE-2006-7102 State: PUBLISHED Published: 2007-03-03T21:00:00 Last Updated: 2024-08-07T20:50:06.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in phpBurningPortal quiz-modul 1.0.1, and possibly earlier, allow remote attackers to execute arbitrary PHP code via a URL in the lang_path parameter to (1) quest_delete.php, (2) quest_edit.php, or (3) quest_news.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/20547 - https://www.exploit-db.com/exploits/2563 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29558
CVE ID: CVE-2006-7103 State: PUBLISHED Published: 2007-03-03T21:00:00 Last Updated: 2024-08-07T20:50:06.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in EZOnlineGallery 1.3 and earlier, and possibly other versions before 1.3.2 Beta, allow remote attackers to (1) determine directory existence via a ".." in the album parameter in a show_album action to (a) ezgallery.php, which produces different responses depending on existence; and read arbitrary image files via a ".." in the album or (2) image parameter to (b) image.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.ezonlinegallery.com/changelog.txt
mage.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.ezonlinegallery.com/changelog.txt - http://www.securityfocus.com/bid/20763 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29836 - http://www.securityfocus.com/archive/1/449889/100/0/threaded - http://www.mayhemiclabs.com/advisories/MHL-2006-003.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/29835 - http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050364.html - http://securityreason.com/securityalert/2362