CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6690
https://notcve.org/view.php?id=CVE-2007-6690
17 Jan 2008 — The Gallery Remote module in Menalto Gallery before 2.2.4 does not check permissions for unspecified GR commands, which has unknown impact and attack vectors. El módulo Gallery Remote para Menalto Gallery anterior a 2.2.4 no comprueba los permisos para comandos GR no especificados, lo cual tiene impacto y vectores de ataque desconocidos. • http://bugs.gentoo.org/show_bug.cgi?id=203217 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6691
https://notcve.org/view.php?id=CVE-2007-6691
17 Jan 2008 — Multiple unspecified vulnerabilities in Menalto Gallery before 2.2.4 have unknown impact, related to (1) "hotlink protection" in the URL rewrite module, (2) a WebDAV view in the WebDAV module, (3) a comment view in the Comment module, (4) unspecified "item information disclosure attacks" in the Core module Gallery application, (5) the slideshow in the Slideshow module, and (6) multiple Print modules. Múltiples vulnerabilidades no especificadas en Menalto Gallery anterior a 2.2.4 tiene impacto desconocido, r... • http://bugs.gentoo.org/show_bug.cgi?id=203217 •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6692
https://notcve.org/view.php?id=CVE-2007-6692
17 Jan 2008 — Open redirect vulnerability in Menalto Gallery before 2.2.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) Core and (2) print modules. Vulnerabilidad de redirección libre en Menalto Gallery, en versiones anteriores a la 2.2.4, permite que atacantes remotos redirijan a los usuarios a sitios web arbitrarios y lleven a cabo ataques de phising, a través de una URL en los módulos (1) Core y (2) print • http://bugs.gentoo.org/show_bug.cgi?id=203217 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2007-4650
https://notcve.org/view.php?id=CVE-2007-4650
04 Sep 2007 — Multiple unspecified vulnerabilities in Gallery before 2.2.3 allow attackers to (1) rename items, (2) read and modify item properties, or (3) lock and replace items via unknown vectors in (a) the WebDAV module; and (4) edit unspecified data files using "linked items" in WebDAV and (b) Reupload modules. Múltiples vulnerabilidades no especificadas en Gallery anterior a 2.2.3 permite a atacantes (1) renombrar artículos, (2) leer y modificar propiedades de artículos, o (3) ver y reemplazar artículos mediante ve... • http://bugs.gentoo.org/show_bug.cgi?id=191587 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 0CVE-2006-4030
https://notcve.org/view.php?id=CVE-2006-4030
16 Aug 2006 — Unspecified vulnerability in the stats module in Gallery 1.5.1-RC2 and earlier allows remote attackers to obtain sensitive information via unspecified attack vectors, related to "two file exposure bugs." Vulnerabilidad no especificada en el módulo de estadísticas en Gallery 1.5.1-RC2 y anteriores permite a atacantes remotos obtener información sensible a través de vectores de ataque desconocidos, relacionados con "dos bugs de exposición de archivos". • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=325285 •
CVSS: 5.0EPSS: 1%CPEs: 1EXPL: 1CVE-2005-1947
https://notcve.org/view.php?id=CVE-2005-1947
09 Jun 2005 — Cross-site request forgery (CSRF) vulnerability in Invision Gallery before 1.3.1 allows remote attackers to delete albums and images as another user via a link or IMG tag to the (1) albums or (2) delimg actions. • http://marc.info/?l=bugtraq&m=111834146710329&w=2 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 6%CPEs: 13EXPL: 1CVE-2003-0614 – Gallery 1.2/1.3.x - Search Engine Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2003-0614
01 Aug 2003 — Cross-site scripting (XSS) vulnerability in search.php of Gallery 1.1 through 1.3.4 allows remote attackers to insert arbitrary web script via the searchstring parameter. Vulnerabilidad en sitios cruzados en search.php de Gallery 1.1 a 1.3.4 permite a atacantes remotos insertar script web mediante el parámetro searchstring • https://www.exploit-db.com/exploits/22961 •
CVSS: 9.8EPSS: 15%CPEs: 1EXPL: 2CVE-2002-1412 – Bharat Mediratta Gallery 1.x - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2002-1412
11 Apr 2003 — Gallery photo album package before 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a modified GALLERY_BASEDIR variable that points to a directory or URL that contains a Trojan horse init.php script. El paquete album de fotos Gallery anterior a 1.3.1permite a atacantes locales y posiblemente remotos ejecutar código arbitrario mediante una variable GALLERY_BASEDIR que apunta a un directorio o una URL que contiene un script php.ini que sea caballo de Troya. • https://www.exploit-db.com/exploits/21676 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2001-0900 – bharat Mediratta Gallery 1.1/1.2 - Directory Traversal
https://notcve.org/view.php?id=CVE-2001-0900
18 Nov 2001 — Directory traversal vulnerability in modules.php in Gallery before 1.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the include parameter. • https://www.exploit-db.com/exploits/21157 •
CVSS: 9.8EPSS: 3%CPEs: 3EXPL: 1CVE-2001-1234
https://notcve.org/view.php?id=CVE-2001-1234
02 Oct 2001 — Bharat Mediratta Gallery PHP script before 1.2.1 allows remote attackers to execute arbitrary code by including files from remote web sites via an HTTP request that modifies the includedir variable. • http://archives.neohapsis.com/archives/bugtraq/2001-10/0012.html •