CVSS: 9.1EPSS: 1%CPEs: 90EXPL: 1CVE-2008-3555 – Wsn (Multiple Products) - Local File Inclusion / Code Execution
https://notcve.org/view.php?id=CVE-2008-3555
08 Aug 2008 — Directory traversal vulnerability in index.php in (1) WSN Forum 4.1.43 and earlier, (2) Gallery 4.1.30 and earlier, (3) Knowledge Base (WSNKB) 4.1.36 and earlier, (4) Links 4.1.44 and earlier, and possibly (5) Classifieds before 4.1.30 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the TID parameter, as demonstrated by uploading a .jpg file containing PHP sequences. Una vulnerabilidad de salto de directorio en el archivo index.php en (1) WSN Forum versión 4.1.43 y... • https://www.exploit-db.com/exploits/6208 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2008-2720
https://notcve.org/view.php?id=CVE-2008-2720
16 Jun 2008 — Cross-site scripting (XSS) vulnerability in Menalto Gallery before 2.2.5 allows remote attackers to inject arbitrary web script or HTML via the (1) host and (2) path components of a URL. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Menalto Gallery anterior a 2.2.5 permite a atacantes remotos inyectar scripts web o HTML mediante los componentes (1) host y (2) path de un URL. • http://gallery.menalto.com/gallery_2.2.5_released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2008-2721
https://notcve.org/view.php?id=CVE-2008-2721
16 Jun 2008 — Unspecified vulnerability in the album-select module in Menalto Gallery before 2.2.5 allows remote attackers to obtain titles of hidden albums by attempting to add a new album to a hidden album. Vulnerabilidad sin expecificar en el módulo de album-select en Menalto Gallery anteriores a 2.2.5, permite a atacantes remotos conseguir títulos de los álbunes ocultos cuando intenta añadir un nuevo album a uno oculto. • http://gallery.menalto.com/gallery_2.2.5_released • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 8EXPL: 0CVE-2008-2722
https://notcve.org/view.php?id=CVE-2008-2722
16 Jun 2008 — Menalto Gallery before 2.2.5 allows remote attackers to bypass permissions for sub-albums via a ZIP archive. Menalto Gallery anterior a 2.2.5, permite a atacantes remotos evitar permisos para sub-albums a través de un archivo ZIP. • http://gallery.menalto.com/gallery_2.2.5_released • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 1%CPEs: 8EXPL: 0CVE-2008-2723
https://notcve.org/view.php?id=CVE-2008-2723
16 Jun 2008 — embed.php in Menalto Gallery before 2.2.5 allows remote attackers to obtain the full path via unknown vectors related to "spoofing the remote address." embed.php de Menalto Gallery versiones anteriores a 2.2.5 permite a atacantes remotos obtener la ruta completa a través de vectores no conocidos relacionados a "suplantación de dirección remota". • http://gallery.menalto.com/gallery_2.2.5_released • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6687
https://notcve.org/view.php?id=CVE-2007-6687
17 Jan 2008 — Multiple cross-site scripting (XSS) vulnerabilities in Menalto Gallery before 2.2.4 allow remote attackers to inject arbitrary web script or HTML via crafted filenames to the (1) Core or (2) add-item modules; or via (3) HTTP PROPPATCH in the WebDAV module. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Menalto Gallery anterior a 2.2.4 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante nombres de fichero manipulados a los módulos (... • http://bugs.gentoo.org/show_bug.cgi?id=203217 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 2%CPEs: 1EXPL: 0CVE-2007-6692
https://notcve.org/view.php?id=CVE-2007-6692
17 Jan 2008 — Open redirect vulnerability in Menalto Gallery before 2.2.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) Core and (2) print modules. Vulnerabilidad de redirección libre en Menalto Gallery, en versiones anteriores a la 2.2.4, permite que atacantes remotos redirijan a los usuarios a sitios web arbitrarios y lleven a cabo ataques de phising, a través de una URL en los módulos (1) Core y (2) print • http://bugs.gentoo.org/show_bug.cgi?id=203217 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2007-6691
https://notcve.org/view.php?id=CVE-2007-6691
17 Jan 2008 — Multiple unspecified vulnerabilities in Menalto Gallery before 2.2.4 have unknown impact, related to (1) "hotlink protection" in the URL rewrite module, (2) a WebDAV view in the WebDAV module, (3) a comment view in the Comment module, (4) unspecified "item information disclosure attacks" in the Core module Gallery application, (5) the slideshow in the Slideshow module, and (6) multiple Print modules. Múltiples vulnerabilidades no especificadas en Menalto Gallery anterior a 2.2.4 tiene impacto desconocido, r... • http://bugs.gentoo.org/show_bug.cgi?id=203217 •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6690
https://notcve.org/view.php?id=CVE-2007-6690
17 Jan 2008 — The Gallery Remote module in Menalto Gallery before 2.2.4 does not check permissions for unspecified GR commands, which has unknown impact and attack vectors. El módulo Gallery Remote para Menalto Gallery anterior a 2.2.4 no comprueba los permisos para comandos GR no especificados, lo cual tiene impacto y vectores de ataque desconocidos. • http://bugs.gentoo.org/show_bug.cgi?id=203217 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6688
https://notcve.org/view.php?id=CVE-2007-6688
17 Jan 2008 — Unspecified vulnerability in the Installation application in Menalto Gallery before 2.2.4 has unknown impact and attack vectors related to "web-accessibility protection of the storage folder." Vulnerabilidad no especificada en la aplicación de instalacón en Menalto Gallery, en versiones anteriores a la 2.2.4. Tiene un impacto desconocido y vectores de ataque relacionados con "Proteccion de la accesibilidad web del directorio de almacenamiento" • http://bugs.gentoo.org/show_bug.cgi?id=203217 •