[CLOSE] OSVDB ID : 72861 - Disclosed: 2011-06-06

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 71029 - Disclosed: 2011-03-08

Description:

1 Flash Gallery Plugin for WordPress contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'type' and 'gall_id' parameters upon submission to the wp-content/plugins/1-flash-gallery/folder.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 71030 - Disclosed: 2011-03-08

Description:

1 Flash Gallery Plugin for WordPress contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the wp-content/plugins/1-flash-gallery/massedit_album.php script not properly sanitizing user-supplied input to the 'gall_id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 21074 - Disclosed: 2005-11-23

Description:

1-2-3 Music Store contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'process.php' script not properly sanitizing user-supplied input to the 'AlbumID' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 36355 - Disclosed: 2007-07-01

Description:

(Description Provided by CVE) : SQL injection vulnerability in process.php in Easybe 1-2-3 Music Store allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter.

[CLOSE] OSVDB ID : 89128 - Disclosed: 2013-01-11

Description:

1-Click-Login (oneclicklogin) Extension for TYPO3 contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input before returning it to the user. This may allow an attacker to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 21437 - Disclosed: 2005-12-05

Description:

1-Search contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'q' parameter upon submission to the '1search.cgi' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 48361 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/admin/lang/fr/reports/default.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'lang' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48365 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/admin/ops/admins/default.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'admin_theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48362 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the /admin/ops/reports/ops/download.php script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'admin_theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48363 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the /admin/ops/reports/ops/forum.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'admin_theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48364 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/admin/ops/reports/news.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'admin_theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48368 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/lang/de/moderator/default.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'lang' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48366 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/lang/en/moderator/default.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'lang' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48367 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/lang/fr/moderator/default.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'lang' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48370 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/pages/download/default/ops/add.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48369 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/pages/download/default/ops/edit.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48373 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the /pages/download/default/ops/newest.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48371 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/pages/download/default/ops/search.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48372 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/pages/donwload/default/ops/top.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48374 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/pages/forum/default/content.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48381 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/themes/blog/layouts/basic_footer.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48382 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/themes/blog/layouts/basic_header.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48383 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/themes/blog/layouts/print.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'page' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48380 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/themes/blog/layouts/standard.php' script not properly sanitizing user input supplied to the 'page_include' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 48384 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/themes/blog/layouts/total.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'theme_dir' and 'page' parameters. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48386 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/themes/default/layouts/basic_footer.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48387 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/themes/default/layouts/basic_header.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48388 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/themes/default/layouts/print.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'page_include' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 48385 - Disclosed: 2008-07-04

Description:

1024 CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the '/themes/default/layouts/standard.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'theme_dir' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.