GA
Product
Gallery
28
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 0Medium 0Low 0
Watch
Add Gallery to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2012-4919 | 9.8 | Jan 22 | Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability Affected: 1.4 |
| CVE-2006-4030 | – | Aug 16 | Unspecified vulnerability in the stats module in Gallery 1.5.1-RC2 and earlier allows remote attackers to obtain sensitive information via unspecified attack vectors, related to… Affected: through 1.5.1_rc2; 1.4; 1.4.1; 1.4.2; 1.4.3_pl1; 1.4.3_pl2; +9 more |
| CVE-2006-1696 | – | Apr 11 | Cross-site scripting (XSS) vulnerability in Gallery before 1.5.3 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors Affected: 1.3.4; 1.4; 1.4.1; 1.4.2; 1.4.3_pl1; 1.4.3_pl2; +14 more |
| CVE-2006-1219 | – | Mar 14 | Directory traversal vulnerability in Gallery 2.0.3 and earlier, and 2.1 before RC-2a, allows remote attackers to include arbitrary PHP files via ".." (dot dot) sequences in the… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0_alpha; 2.0_alpha1; +8 more |
| CVE-2006-1126 | – | Mar 9 | Gallery 2 up to 2.0.2 allows remote attackers to spoof their IP address via a modified X-Forwarded-For (X_FORWARDED_FOR) HTTP header, which is checked by Gallery before other more… Affected: 2.0.2 |
| CVE-2006-1128 | – | Mar 9 | Directory traversal vulnerability in the session handling class (GallerySession.class) in Gallery 2 up to 2.0.2 allows remote attackers to access and delete files by specifying… Affected: 2.0; 2.0.1; 2.0.2; 2.0_alpha; 2.0_alpha1; 2.0_alpha2; +5 more |
| CVE-2006-1127 | – | Mar 9 | Cross-site scripting (XSS) vulnerability in Gallery 2 up to 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For (X_FORWARDED_FOR) HTTP… Affected: 2.0; 2.0.1; 2.0.2; 2.0_alpha; 2.0_alpha1; 2.0_alpha2; +5 more |
| CVE-2006-0587 | – | Feb 8 | Unspecified vulnerability in util.php in Gallery before 1.5.2-pl2 allows remote authenticated users with trick an owner into modifying stored album data and possibly executing… Affected: 1.3.4; 1.4; 1.4.1; 1.4.2; 1.4.3_pl1; 1.4.3_pl2; +10 more |
| CVE-2006-0330 | – | Jan 21 | Cross-site scripting (XSS) vulnerability in Gallery before 1.5.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, possibly involving the… Affected: 1.3.4; 1.4; 1.4.1; 1.4.2; 1.4.3_pl1; 1.4.3_pl2; +10 more |
| CVE-2005-4023 | – | Dec 5 | Unspecified vulnerability in the zipcart module in Gallery 2.0 before 2.0.2 allows remote attackers to read arbitrary files via unknown vectors Affected: 2.0; 2.0.1; 2.0_alpha3; 2.0_alpha4; 2.0_beta1; 2.0_beta2; +3 more |
| CVE-2005-4021 | – | Dec 5 | The installer for Gallery 2.0 before 2.0.2 stores the install log under the web document root with insufficient access control, which allows remote attackers to obtain sensitive… Affected: 2.0; 2.0.1; 2.0_alpha1; 2.0_alpha2; 2.0_alpha3; 2.0_alpha4; +5 more |
| CVE-2005-3251 | – | Oct 17 | Directory traversal vulnerability in the gallery script in Gallery 2.0 (G2) allows remote attackers to read or include arbitrary files via ".." sequences in the g2_itemId… Affected: 2.0; 2.0_alpha1; 2.0_alpha2; 2.0_alpha3; 2.0_alpha4; 2.0_beta1; +2 more |
| CVE-2005-2734 | – | Aug 30 | Cross-site scripting (XSS) vulnerability in Gallery 1.5.1-RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Camera Model… Affected: 1.4; 1.4.1; 1.4.2; 1.4.3_pl1; 1.4.3_pl2; 1.4.4_pl2; +8 more |
| CVE-2005-2596 | – | Aug 17 | User.php in Gallery, as used in Postnuke, allows users with any Admin privileges to gain access to all galleries Affected: 1.3.4 |
| CVE-2005-0219 | – | May 2 | Multiple cross-site scripting (XSS) vulnerabilities in Gallery 1.3.4-pl1 allow remote attackers to inject arbitrary web script or HTML via (1) the index field in add_comment.php,… Affected: 1.3.4_pl1 |
| CVE-2005-0222 | – | May 2 | main.php in Gallery 2.0 Alpha allows remote attackers to gain sensitive information by changing the value of g2_subView parameter, which reveals the path in an error message Affected: 2.0_alpha |
| CVE-2005-0220 | – | May 2 | Cross-site scripting vulnerability in login.php in Gallery 1.4.4-pl2 allows remote attackers to inject arbitrary web script or HTML via the username field Affected: 1.4.4_pl2 |
| CVE-2005-0221 | – | Jan 17 | Cross-site scripting (XSS) vulnerability in login.php in Gallery 2.0 Alpha allows remote attackers to inject arbitrary web script or HTML via the g2_form[subject] field Affected: 2.0_alpha |
| CVE-2004-1106 | – | Jan 10 | Cross-site scripting (XSS) vulnerability in Gallery 1.4.4-pl3 and earlier allows remote attackers to execute arbitrary web script or HTML via "specially formed URLs," possibly via… Affected: 1.4; 1.4.1; 1.4.2; 1.4.3_pl1; 1.4.3_pl2; 1.4_pl1; +1 more |
| CVE-2004-1466 | – | Dec 31 | The set_time_limit function in Gallery before 1.4.4_p2 deletes non-image files in a temporary directory every 30 seconds after they have been uploaded using save_photos.php, which… Affected: 1.4.4 |
| CVE-2004-2124 | – | Dec 31 | The register_globals simulation capability in Gallery 1.3.1 through 1.4.1 allows remote attackers to modify the HTTP_POST_VARS variable and conduct a PHP remote file inclusion… Affected: 1.3.1; 1.3.2; 1.3.3; 1.4; 1.4.1 |
| CVE-2004-0522 | – | Aug 6 | Gallery 1.4.3 and earlier allows remote attackers to bypass authentication and obtain Gallery administrator privileges Affected: 1.4; 1.4.1; 1.4.2; 1.4.3_pl1; 1.4_pl1; 1.4_pl2 |
| CVE-2003-1227 | – | Dec 31 | PHP remote file include vulnerability in index.php for Gallery 1.4 and 1.4-pl1, when running on Windows or in Configuration mode on Unix, allows remote attackers to inject… Affected: 1.4; 1.4_pl1 |
| CVE-2003-0614 | – | Aug 27 | Cross-site scripting (XSS) vulnerability in search.php of Gallery 1.1 through 1.3.4 allows remote attackers to insert arbitrary web script via the searchstring parameter Affected: 1.1; 1.2; 1.2.1; 1.2.1_p1; 1.2.2; 1.2.3; +7 more |
| CVE-2002-1412 | – | Apr 11 | Gallery photo album package before 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a modified GALLERY_BASEDIR variable that points to a directory or… Affected: through 1.3.1 |
| CVE-2002-2123 | – | Dec 31 | PHP remote file inclusion vulnerability in publish_xp_docs.php for Gallery 1.3.2 allows remote attackers to inject arbitrary PHP code by specifying a URL to an init.php file in… Affected: 1.3.2 |
| CVE-2002-2130 | – | Dec 31 | publish_xp_docs.php in Gallery 1.3.2 allows remote attackers to execute arbitrary PHP code by modifying the GALLERY_BASEDIR parameter to reference a URL on a remote web server… Affected: 1.3.2 |
| CVE-2001-1234 | – | Oct 2 | Bharat Mediratta Gallery PHP script before 1.2.1 allows remote attackers to execute arbitrary code by including files from remote web sites via an HTTP request that modifies the… Affected: 1.1; 1.2; 1.2.1 |
Showing 28