CVE

Id
19440  
CVE No.
CVE-2006-3336  
Status
Candidate  
Description
TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload filter and execute arbitrary code via filenames with double extensions such as ".php.en", ".php.1", and other allowed extensions that are not .txt. NOTE: this is only a vulnerability when the server allows script execution in the pub directory.  
Phase
Assigned (20060702)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
174540 19440 CVE-2006-3336 CONFIRM:http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads  View
174541 19440 CVE-2006-3336 BID:18854  View
174542 19440 CVE-2006-3336 URL:http://www.securityfocus.com/bid/18854  View
174543 19440 CVE-2006-3336 VUPEN:ADV-2006-2677  View
174544 19440 CVE-2006-3336 URL:http://www.vupen.com/english/advisories/2006/2677  View
174545 19440 CVE-2006-3336 SECTRACK:1016458  View
174546 19440 CVE-2006-3336 URL:http://securitytracker.com/id?1016458  View
174547 19440 CVE-2006-3336 SECUNIA:20992  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
61786 JVNDB-2006-004052 Atlassian JIRA におけるクロスサイトスクリプティングの脆弱性 Atlassian JIRA には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2006-3338 19440 2.6 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-004052.html  View