Zeroboard : Security Vulnerabilities

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complex ity	Authen tication	Confiden tiality	Integrity	Availa bility
1	CVE-2006-3070		Bypass	2006-06-19	2008-09-10	5.0	None	Remote	Low	Not required	None	Partial	None
write_ok.php in Zeroboard 4.1 pl8, when installed on Apache with mod_mime, allows remote attackers to bypass restrictions for uploading files with executable extensions by uploading a .htaccess file that with an AddType directive that assigns an executable module to files with assumed-safe extensions, as demonstrated by assigning the txt extension to be handled by application/x-httpd-php.
2	CVE-2006-1222		XSS	2006-03-14	2008-09-05	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in zeroboard 4.1 pl7 allows allow remote attackers to inject arbitrary web script or HTML via the (1) memo box title, (2) user email, and (3) homepage fields.
3	CVE-2005-1820		Exec Code	2005-06-01	2008-09-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
zboard.php in Zeroboard version 4.1pl2 to 4.1pl5 allows remote attackers to execute arbitrary PHP code via improper quoting when using the preg_replace function.
4	CVE-2005-0495		XSS	2005-02-19	2008-09-05	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in ZeroBoard allows remote attackers to inject arbitrary web script or HTML via the (1) sn1, (2) year, or (3) page parameter to zboard.php or (4) filename to view_image.php.
5	CVE-2005-0380		Exec Code File Inclusion	2005-05-02	2008-09-10	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple PHP remote file inclusion vulnerabilities in (1) print_category.php, (2) login.php, (3) setup.php, (4) ask_password.php, or (5) error.php in ZeroBoard 4.1pl5 and earlier allow remote attackers to execute arbitrary PHP code by modifying the dir parameter to reference a URL on a remote web server that contains the code.
6	CVE-2005-0379		Dir. Trav.	2005-05-02	2008-09-10	5.0	None	Remote	Low	Not required	Partial	None	None
Multiple directory traversal vulnerabilities in ZeroBoard 4.1pl5 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the _zb_path parameter to (1) _head.php or (2) outlogin.php, or the dir parameter to (3) write.php.
7	CVE-2004-2738	79	XSS	2004-12-31	2008-09-05	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in check_user_id.php in ZeroBoard 4.1pl4 and earlier allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.
8	CVE-2004-1419	94	Exec Code File Inclusion	2004-12-31	2008-09-05	6.8	User	Remote	Medium	Not required	Partial	Partial	Partial
PHP remote file inclusion vulnerability in ZeroBoard 4.1pl4 and earlier allows remote attackers to execute arbitrary PHP code by modifying the (1) _zb_path parameter to outlogin.php or (2) dir parameter to write.php to reference a URL on a remote web server that contains the code.
9	CVE-2002-1704		Exec Code	2002-12-31	2008-09-05	5.0	None	Remote	Low	Not required	None	Partial	None
Zeroboard 4.1, when the "allow_url_fopen" and "register_globals" variables are enabled, allows remote attackers to execute arbitrary PHP code by modifying the _zb_path parameter to reference a URL on a remote web server that contains the code.

Total number of vulnerabilities : 9 Page : 1 (This Page)