CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2008-4803 – Simple PHP Scripts Gallery 0.x - 'index.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-4803
Cross-site scripting (XSS) vulnerability in index.php in Simple PHP Scripts gallery 0.1, 0.3, and 0.4 allows remote attackers to inject arbitrary web script or HTML via the gallery parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en index.php en Simple PHP Scripts gallery 0.1, 0.3 y 0.4 permite a atacantes remotos inyectar secuencias de comandos web o HTML mediante el parámetro gallery. NOTA: el origen de esta información es desconocido; los detalles se han obtenido únicamente de información de terceros. • https://www.exploit-db.com/exploits/31319 http://www.securityfocus.com/bid/28056 https://exchange.xforce.ibmcloud.com/vulnerabilities/40985 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 2CVE-2008-4483 – Crux Gallery 1.32 - 'theme' Local File Inclusion
https://notcve.org/view.php?id=CVE-2008-4483
Directory traversal vulnerability in index.php in Crux Gallery 1.32 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme parameter. Vulnerabilidad de salto de directorio en el archivo index.php en Crux Gallery 1.32 y versiones anteiores, cuando magic_quotes_gpc es deshabiitado, permite a los atacantes remotos incluir y ejecutar arbitrariamente archivos locales a través de .. (punto punto) en el parámetro theme. • https://www.exploit-db.com/exploits/6645 http://secunia.com/advisories/32058 http://securityreason.com/securityalert/4366 http://www.securityfocus.com/bid/31516 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.8EPSS: 6%CPEs: 7EXPL: 1CVE-2008-4484 – Crux Gallery 1.32 - Insecure Cookie Handling
https://notcve.org/view.php?id=CVE-2008-4484
main.php in Crux Gallery 1.32 and earlier allows remote attackers to gain administrative access by setting the name parameter to "users," as demonstrated via index.php. main.php en Crux Gallery 1.32 y versiones anteriores, supone que el usuario es un administrador, si el nombre del parámetro no es "users", el cual permite a los atacantes remotos obtener acceso como administrador, estableciendo el nombre del parámetro a "users", como se demuestra a través de index.php. • https://www.exploit-db.com/exploits/6586 http://secunia.com/advisories/32058 http://securityreason.com/securityalert/4365 http://www.attrition.org/pipermail/vim/2008-October/002083.html http://www.securityfocus.com/archive/1/496763/100/0/threaded http://www.securityfocus.com/bid/31430 https://exchange.xforce.ibmcloud.com/vulnerabilities/45443 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.0EPSS: 0%CPEs: 7EXPL: 0CVE-2008-4129
https://notcve.org/view.php?id=CVE-2008-4129
Gallery before 1.5.9, and 2.x before 2.2.6, does not properly handle ZIP archives containing symbolic links, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files via vectors related to the archive upload (aka zip upload) functionality. Gallery, versiones anteriores a 1.5.9, y 2.x y versiones anteriores a 2.2.6, no trata adecuadamente archivos ZIP que contienen enlaces simbólicos, el cual permite a los usuarios remotos autentificados manejar los ataques de salto de directorio y leer archivos arbitrariamente a través de vectores relativos a el fichero cargado funcionalmente (alias zip cargado). • http://gallery.menalto.com/gallery_1.5.9_released http://gallery.menalto.com/gallery_2.2.6_released http://secunia.com/advisories/31912 http://secunia.com/advisories/32662 http://secunia.com/advisories/33144 http://security.gentoo.org/glsa/glsa-200811-02.xml http://www.securityfocus.com/bid/31231 https://exchange.xforce.ibmcloud.com/vulnerabilities/45228 https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00794.html https://www.redhat.com/archives/fedora-package& • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2008-4130
https://notcve.org/view.php?id=CVE-2008-4130
Cross-site scripting (XSS) vulnerability in Gallery 2.x before 2.2.6 allows remote attackers to inject arbitrary web script or HTML via a crafted Flash animation, related to the ability of the animation to "interact with the embedding page." Vulnerabilidad de secuencias de comandos en sitios cruzados - XSS en Gallery 2.x y versiones anteriores a 2.2.6 que permite a los atacantes remotos inyectar una secuencia de comandos web o HTML arbitrarios a través de una animación Flash manitulada, en relación a la habilidad de la animación a "interactuar con la página incrustada" • http://gallery.menalto.com/gallery_2.2.6_released http://secunia.com/advisories/31858 http://secunia.com/advisories/32662 http://secunia.com/advisories/33144 http://security.gentoo.org/glsa/glsa-200811-02.xml http://www.securityfocus.com/bid/31231 https://exchange.xforce.ibmcloud.com/vulnerabilities/45227 https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00794.html https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00832.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •