CVSS: 5.3EPSS: 0%CPEs: 7EXPL: 0CVE-2008-3662
https://notcve.org/view.php?id=CVE-2008-3662
18 Sep 2008 — Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie. Gallery, versiones anteriores a 1.5.9, 2.x y versiones anteriores a 2.2.6 no asigna el indicador seguro para la cookie de sesión en una sesión https, el cual puede causar que la cookie sea enviada en una petición http y hacer más fácil a los atacantes remotos capturar esta co... • http://gallery.menalto.com/gallery_1.5.9_released • CWE-310: Cryptographic Issues •
CVSS: 9.1EPSS: 1%CPEs: 90EXPL: 1CVE-2008-3555 – Wsn (Multiple Products) - Local File Inclusion / Code Execution
https://notcve.org/view.php?id=CVE-2008-3555
08 Aug 2008 — Directory traversal vulnerability in index.php in (1) WSN Forum 4.1.43 and earlier, (2) Gallery 4.1.30 and earlier, (3) Knowledge Base (WSNKB) 4.1.36 and earlier, (4) Links 4.1.44 and earlier, and possibly (5) Classifieds before 4.1.30 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the TID parameter, as demonstrated by uploading a .jpg file containing PHP sequences. Una vulnerabilidad de salto de directorio en el archivo index.php en (1) WSN Forum versión 4.1.43 y... • https://www.exploit-db.com/exploits/6208 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2008-2721
https://notcve.org/view.php?id=CVE-2008-2721
16 Jun 2008 — Unspecified vulnerability in the album-select module in Menalto Gallery before 2.2.5 allows remote attackers to obtain titles of hidden albums by attempting to add a new album to a hidden album. Vulnerabilidad sin expecificar en el módulo de album-select en Menalto Gallery anteriores a 2.2.5, permite a atacantes remotos conseguir títulos de los álbunes ocultos cuando intenta añadir un nuevo album a uno oculto. • http://gallery.menalto.com/gallery_2.2.5_released • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2008-2720
https://notcve.org/view.php?id=CVE-2008-2720
16 Jun 2008 — Cross-site scripting (XSS) vulnerability in Menalto Gallery before 2.2.5 allows remote attackers to inject arbitrary web script or HTML via the (1) host and (2) path components of a URL. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Menalto Gallery anterior a 2.2.5 permite a atacantes remotos inyectar scripts web o HTML mediante los componentes (1) host y (2) path de un URL. • http://gallery.menalto.com/gallery_2.2.5_released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2008-2722
https://notcve.org/view.php?id=CVE-2008-2722
16 Jun 2008 — Menalto Gallery before 2.2.5 allows remote attackers to bypass permissions for sub-albums via a ZIP archive. Menalto Gallery anterior a 2.2.5, permite a atacantes remotos evitar permisos para sub-albums a través de un archivo ZIP. • http://gallery.menalto.com/gallery_2.2.5_released • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2008-2723
https://notcve.org/view.php?id=CVE-2008-2723
16 Jun 2008 — embed.php in Menalto Gallery before 2.2.5 allows remote attackers to obtain the full path via unknown vectors related to "spoofing the remote address." embed.php de Menalto Gallery versiones anteriores a 2.2.5 permite a atacantes remotos obtener la ruta completa a través de vectores no conocidos relacionados a "suplantación de dirección remota". • http://gallery.menalto.com/gallery_2.2.5_released • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6686
https://notcve.org/view.php?id=CVE-2007-6686
17 Jan 2008 — The URL rewrite module in Menalto Gallery before 2.2.4 allows attackers to include and execute arbitrary local files via unknown vectors related to the admin controller. El módulo URL rewrite para Menalto Gallery anterior a 2.2.4 permite a atacantes remotos incluir y ejecutar ficheros locales de su elección mediante vectores desconocidos relacionados con el controlador de la administración. • http://bugs.gentoo.org/show_bug.cgi?id=203217 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6687
https://notcve.org/view.php?id=CVE-2007-6687
17 Jan 2008 — Multiple cross-site scripting (XSS) vulnerabilities in Menalto Gallery before 2.2.4 allow remote attackers to inject arbitrary web script or HTML via crafted filenames to the (1) Core or (2) add-item modules; or via (3) HTTP PROPPATCH in the WebDAV module. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Menalto Gallery anterior a 2.2.4 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante nombres de fichero manipulados a los módulos (... • http://bugs.gentoo.org/show_bug.cgi?id=203217 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6692
https://notcve.org/view.php?id=CVE-2007-6692
17 Jan 2008 — Open redirect vulnerability in Menalto Gallery before 2.2.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) Core and (2) print modules. Vulnerabilidad de redirección libre en Menalto Gallery, en versiones anteriores a la 2.2.4, permite que atacantes remotos redirijan a los usuarios a sitios web arbitrarios y lleven a cabo ataques de phising, a través de una URL en los módulos (1) Core y (2) print • http://bugs.gentoo.org/show_bug.cgi?id=203217 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2007-6691
https://notcve.org/view.php?id=CVE-2007-6691
17 Jan 2008 — Multiple unspecified vulnerabilities in Menalto Gallery before 2.2.4 have unknown impact, related to (1) "hotlink protection" in the URL rewrite module, (2) a WebDAV view in the WebDAV module, (3) a comment view in the Comment module, (4) unspecified "item information disclosure attacks" in the Core module Gallery application, (5) the slideshow in the Slideshow module, and (6) multiple Print modules. Múltiples vulnerabilidades no especificadas en Menalto Gallery anterior a 2.2.4 tiene impacto desconocido, r... • http://bugs.gentoo.org/show_bug.cgi?id=203217 •