Debian Security Advisory DSA 1170-1 (gcc-3.4)

The remote host is missing an update to gcc-3.4 announced via advisory DSA 1170-1. Jürgen Weigert discovered that upon unpacking JAR archives fastjar from the GNU Compiler Collection does not check the path for included files and allows to create or overwrite files in upper directories. OpenVAS...

Debian Security Advisory DSA 1199-1 (webmin)

The remote host is missing an update to webmin announced via advisory DSA 1199-1. Several vulnerabilities have been identified in webmin, a web-based administration toolkit. CVE-2005-3912 A format string vulnerability in miniserv.pl could allow an attacker to cause a denial of service by crashing...

Debian: Security Advisory (DSA-1086-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-615-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

VFS in the Linux kernel before 2.6.22.16, and 2.6.23.x before 2.6.23.14, performs tests of access mode by using the flag variable instead of the accmode variable, which might allow local users to bypass intended permissions and remove directories...

Jetty fails to properly process URLs that contain double / characters

Overview The Jetty web server contains a vulnerability that may allow an attacker to access private files or directories. Description Jetty is a web server that is implemented in Java. Jetty contains a vulnerability in the way it processes URLs with multiple "/" slash characters. See the Jetty...

CVE-2007-6481

Unspecified vulnerability in the Device Manager daemon utdevmgrd in Sun Ray Server Software 2.0, 3.0, 3.1, and 3.1.1 allows remote attackers to create or delete arbitrary directories via unspecified vectors...

Design/Logic Flaw

Unspecified vulnerability in the Device Manager daemon utdevmgrd in Sun Ray Server Software 2.0, 3.0, 3.1, and 3.1.1 allows remote attackers to create or delete arbitrary directories via unspecified vectors...

CVE-2007-6481

Unspecified vulnerability in the Device Manager daemon utdevmgrd in Sun Ray Server Software 2.0, 3.0, 3.1, and 3.1.1 allows remote attackers to create or delete arbitrary directories via unspecified vectors...

Remote code execution

incnewuser.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change the permissions of directories named 1 db, 2 www, 3 Special, and 4 log at arbitrary locations under the web root via a modified Dirroot parameter in an AddUser action to...

CVE-2007-6481

Unspecified vulnerability in the Device Manager daemon utdevmgrd in Sun Ray Server Software 2.0, 3.0, 3.1, and 3.1.1 allows remote attackers to create or delete arbitrary directories via unspecified vectors...

[SECURITY] Fedora 8 Update: xfce4-places-plugin-1.0.0-2.fc8

A menu with quick access to folders, documents, and removable media. The Places plugin brings much of the functionality of GNOME=E2=80=99s Places me nu to Xfce. It puts a simple button on the panel. Clicking on this button opens up a menu with 4 sections: 1 System-defined directories home folder,...

CVE-2007-6317

Multiple directory traversal vulnerabilities in BarracudaDrive Web Server before 3.8 allow 1 remote attackers to read arbitrary files via certain ..\ dot dot backslash sequences in the URL path, or 2 remote authenticated users to delete arbitrary files or create arbitrary directories via a ..\ do...

openSUSE 10 Security Update : wget (wget-1689)

This update fixes a security in wget, where evil servers could send terminal escape codes to the user calling wget. This would only affect interactive sessions. CVE-2004-1488 Additionaly a previous '.file' fix was found to be buggy and replaced. This bug could lead to '.directories' not being...

CVE-2003-1349

Directory traversal vulnerability in NITE ftp-server NiteServer 1.83 allows remote attackers to list arbitrary directories via a ".." backslash dot dot in the CD CWD command...

CVE-2007-5454

Directory traversal vulnerability in index.php in PHP File Sharing System 1.5.1 allows remote attackers to list or create arbitrary directories, or delete arbitrary files, as demonstrated by listing directories via a .. dot dot in the cam parameter...

Directory traversal

Directory traversal vulnerability in index.php in PHP File Sharing System 1.5.1 allows remote attackers to list or create arbitrary directories, or delete arbitrary files, as demonstrated by listing directories via a .. dot dot in the cam parameter...

CVE-2007-5454

Directory traversal vulnerability in index.php in PHP File Sharing System 1.5.1 allows remote attackers to list or create arbitrary directories, or delete arbitrary files, as demonstrated by listing directories via a .. dot dot in the cam parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ActiveKB NX 2.5.4 allow remote attackers to inject arbitrary web script or HTML via the page parameter to the default URI for some directories, as demonstrated by 1 ActiveKB/ and 2 default/categories/ActiveKB/...

CVE-2007-5426

Multiple cross-site scripting XSS vulnerabilities in ActiveKB NX 2.5.4 allow remote attackers to inject arbitrary web script or HTML via the page parameter to the default URI for some directories, as demonstrated by 1 ActiveKB/ and 2 default/categories/ActiveKB/...