Page 2 of 17 results (0.005 seconds)

CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 1

CVE-2007-4028

https://notcve.org/view.php?id=CVE-2007-4028

Absolute path traversal vulnerability in index.php in Webspell 4.01.02 allows remote attackers to include and execute arbitrary local files via a full pathname in the site parameter. NOTE: some of these details are obtained from third party information. Vulnerabilidad de salto de ruta absoluta en el index.php del Webspell 4.01.02 permite a atacantes remotos incluir y ejecutar ficheros locales de su elección a través de un pathname completo en el parámetro site. NOTA: algunos de estos detalles se obtienen a partir de la información de terceros. • http://osvdb.org/37516 http://secunia.com/advisories/26172 http://securityreason.com/securityalert/2927 http://www.securityfocus.com/archive/1/474416/100/0/threaded http://www.securityfocus.com/bid/25012 •

CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 1

CVE-2007-2369 – WebSPELL 4.01.02 - 'picture.php' File Disclosure

https://notcve.org/view.php?id=CVE-2007-2369

Directory traversal vulnerability in picture.php in WebSPELL 4.01.02 and earlier, when PHP before 4.3.0 is used, allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter. Vulnerabilidad de salto de directorio en picture.php de WebSPELL 4.01.02 y anteriores, cuando se está utilizando PHP anterior a 4.3.0, permite a atacantes remotos leer ficheros de su elección mediante secuencias .. (punto punto) en el parámetro id. • https://www.exploit-db.com/exploits/3673 http://osvdb.org/34638 http://www.vupen.com/english/advisories/2007/1274 •

CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1

CVE-2007-2368 – WebSPELL 4.01.02 - 'picture.php' File Disclosure

https://notcve.org/view.php?id=CVE-2007-2368

picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter. picture.php en WebSPELL 4.01.02 y anteriores permite a atacantes remotos leer ficheros de su elección mediante el parámetro file. • https://www.exploit-db.com/exploits/3673 http://www.vupen.com/english/advisories/2007/1274 •

CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 2

CVE-2007-1163 – webSPELL 4.01.02 - 'topic' SQL Injection

https://notcve.org/view.php?id=CVE-2007-1163

SQL injection vulnerability in printview.php in webSPELL 4.01.02 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter, a different vector than CVE-2007-1019, CVE-2006-5388, and CVE-2006-4783. Vulnerabilidad de inyección SQL en printview.php de webSPELL 4.01.02 y versiones anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro topic, vector distinto a CVE-2007-1019, CVE-2006-5388, y CVE-2006-4783. • https://www.exploit-db.com/exploits/3351 http://osvdb.org/33231 http://secunia.com/advisories/24257 http://www.securityfocus.com/bid/22659 http://www.vupen.com/english/advisories/2007/0714 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0

CVE-2007-1160

https://notcve.org/view.php?id=CVE-2007-1160

webSPELL 4.0, and possibly later versions, allows remote attackers to bypass authentication via a ws_auth cookie, a different vulnerability than CVE-2006-4782. webSPELL 4.0, y posiblemente versiones posteriores, permite a atacantes remotos evitar autenticación mediante una cookie ws_auth, vulnerabilidad diferente a CVE-2006-4782. • http://osvdb.org/33143 http://securityreason.com/securityalert/2337 http://www.securityfocus.com/archive/1/460937/100/0/threaded • CWE-287: Improper Authentication •