CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6686
https://notcve.org/view.php?id=CVE-2007-6686
17 Jan 2008 — The URL rewrite module in Menalto Gallery before 2.2.4 allows attackers to include and execute arbitrary local files via unknown vectors related to the admin controller. El módulo URL rewrite para Menalto Gallery anterior a 2.2.4 permite a atacantes remotos incluir y ejecutar ficheros locales de su elección mediante vectores desconocidos relacionados con el controlador de la administración. • http://bugs.gentoo.org/show_bug.cgi?id=203217 •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2007-6689
https://notcve.org/view.php?id=CVE-2007-6689
17 Jan 2008 — Menalto Gallery before 2.2.4 does not properly check for malicious file extensions during file uploads, which allows attackers to execute arbitrary code via the (1) Core application or (2) MIME module. Menalto Gallery anterior a 2.2.4 no comprueba extensiones de fichero maliciosas durante la subida de ficheros, lo cual permite a atacantes remotos ejecutar código de su elección mediante los módulos (1) Core o (2) MIME. • http://bugs.gentoo.org/show_bug.cgi?id=203217 • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2007-4650
https://notcve.org/view.php?id=CVE-2007-4650
04 Sep 2007 — Multiple unspecified vulnerabilities in Gallery before 2.2.3 allow attackers to (1) rename items, (2) read and modify item properties, or (3) lock and replace items via unknown vectors in (a) the WebDAV module; and (4) edit unspecified data files using "linked items" in WebDAV and (b) Reupload modules. Múltiples vulnerabilidades no especificadas en Gallery anterior a 2.2.3 permite a atacantes (1) renombrar artículos, (2) leer y modificar propiedades de artículos, o (3) ver y reemplazar artículos mediante ve... • http://bugs.gentoo.org/show_bug.cgi?id=191587 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 1%CPEs: 15EXPL: 0CVE-2006-4030
https://notcve.org/view.php?id=CVE-2006-4030
16 Aug 2006 — Unspecified vulnerability in the stats module in Gallery 1.5.1-RC2 and earlier allows remote attackers to obtain sensitive information via unspecified attack vectors, related to "two file exposure bugs." Vulnerabilidad no especificada en el módulo de estadísticas en Gallery 1.5.1-RC2 y anteriores permite a atacantes remotos obtener información sensible a través de vectores de ataque desconocidos, relacionados con "dos bugs de exposición de archivos". • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=325285 •
CVSS: 6.1EPSS: 0%CPEs: 20EXPL: 0CVE-2006-1696
https://notcve.org/view.php?id=CVE-2006-1696
11 Apr 2006 — Cross-site scripting (XSS) vulnerability in Gallery before 1.5.3 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. • http://secunia.com/advisories/19580 •
CVSS: 8.0EPSS: 0%CPEs: 16EXPL: 0CVE-2006-0587
https://notcve.org/view.php?id=CVE-2006-0587
08 Feb 2006 — Unspecified vulnerability in util.php in Gallery before 1.5.2-pl2 allows remote authenticated users with trick an owner into modifying stored album data and possibly executing arbitrary code via unspecified vectors involving a crafted link to a crafted file. Vulnerabilidad no especificada en util.php de Gallery anteriores a 1.5.2-pl12 permite a usuarios remotos autenticados engañar a un propietario para modificar datos de álbumes almacenados y posiblemente ejecutar código de su elección mediante vectores no... • http://archives.neohapsis.com/archives/bugtraq/2006-02/0224.html •
CVSS: 6.1EPSS: 0%CPEs: 16EXPL: 0CVE-2006-0330
https://notcve.org/view.php?id=CVE-2006-0330
21 Jan 2006 — Cross-site scripting (XSS) vulnerability in Gallery before 1.5.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, possibly involving the user name (fullname). • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=325285 •
CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0CVE-2005-2734
https://notcve.org/view.php?id=CVE-2005-2734
29 Aug 2005 — Cross-site scripting (XSS) vulnerability in Gallery 1.5.1-RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Camera Model Tag. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=325285 •
CVSS: 6.8EPSS: 1%CPEs: 8EXPL: 0CVE-2004-1106
https://notcve.org/view.php?id=CVE-2004-1106
01 Dec 2004 — Cross-site scripting (XSS) vulnerability in Gallery 1.4.4-pl3 and earlier allows remote attackers to execute arbitrary web script or HTML via "specially formed URLs," possibly via the include parameter in index.php. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Gallery 1.4.4-pl3 y anteriores permite a atacantes remotos ejecutar script web o HTML de su elección mediante "URL s especialmente malformadas", posiblemente mediante un parámetro include en index.php • http://g3cko.info/gallery2-4.patch •
CVSS: 10.0EPSS: 0%CPEs: 18EXPL: 0CVE-2004-0522
https://notcve.org/view.php?id=CVE-2004-0522
08 Jun 2004 — Gallery 1.4.3 and earlier allows remote attackers to bypass authentication and obtain Gallery administrator privileges. Gallery 1.4.3 y anteriores permite a atacantes remotos saltarse la autenticación y obtener privilegios de administrador de Gallery. • http://secunia.com/advisories/11752 •