Page 3 of 13 results (0.005 seconds)

CVSS: 6.0EPSS: 12%CPEs: 5EXPL: 1

CVE-2009-4098 – OpenX - 'banner-edit.php' Arbitrary File Upload / PHP Code Execution

https://notcve.org/view.php?id=CVE-2009-4098

Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file upload permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an images directory. Vulnerabilidad de subida de archivos sin restricción en banner-edit.php en OpenX adserver v2.8.1 y anteriores permite a usuarios autenticados remotamente con permisos de subida banner / file, ejecutar código de su elección mediante la carga de un archivo con una extensión ejecutable, luego accede a él a través de una petición directa al archivo en un directorio imagen. • https://www.exploit-db.com/exploits/16903 http://osvdb.org/60499 http://secunia.com/advisories/37475 http://www.openx.org/docs/2.8/release-notes/openx-2.8.2 http://www.securityfocus.com/archive/1/508050/100/0/threaded http://www.securityfocus.com/bid/37110 https://developer.openx.org/jira/browse/OX-5747 https://exchange.xforce.ibmcloud.com/vulnerabilities/54394 • CWE-20: Improper Input Validation •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2

CVE-2008-6163 – OpenX 2.6 - 'bannerid' Blind SQL Injection

https://notcve.org/view.php?id=CVE-2008-6163

SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL commands via the bannerid parameter. Vulnerabilidad de inyección SQL en www/delivery/ac.php en OpenX v2.6.1 permite a atacantes remotos ejecutar comandos SQL a través del parámetro "bannerid" • https://www.exploit-db.com/exploits/6655 http://forum.openx.org/index.php?s=8d4c74dab4fd4597a7facda7c7414703&showtopic=503422735 http://secunia.com/advisories/32114 http://www.securityfocus.com/bid/31549 https://exchange.xforce.ibmcloud.com/vulnerabilities/45631 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 3

CVE-2009-0291 – OpenX 2.6.3 - 'MAX_type' Local File Inclusion

https://notcve.org/view.php?id=CVE-2009-0291

Directory traversal vulnerability in fc.php in OpenX 2.6.3 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the MAX_type parameter. Vulnerabilidad de salto de directorio en el archivo fc.php en OpenX 2.6.3, permite a los atacantes remotos incluir y ejecutar arbitrariamente archivos a través de .. (punto punto) en el parámetro MAX_type. • https://www.exploit-db.com/exploits/7883 https://www.exploit-db.com/exploits/32759 http://www.securityfocus.com/archive/1/500411/100/0/threaded http://www.securityfocus.com/bid/33458 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •