3301 matches found
adv45-K-159-2006.txt
ECHOADV45$2006 ----------------------------------------------------------------------------------------- ECHOADV45$2006 WEBinsta CMS 0.3.1 templatesdir Remote File Inclusion Vulnerability ----------------------------------------------------------------------------------------- Author : M.Hasran...
security flaw
Cross-site scripting XSS vulnerability in phpinfo info.c in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including 1 a large number of dimensions or 2 long values, which prevents HTML tags from being removed...
DEBIAN-CVE-2006-3360
Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. dot dot sequence and a trailing null %00 byte in the lng parameter, which will display a different error message if the file exists...
PT-2006-4252 · Phpsysinfo · Phpsysinfo
Name of the Vulnerable Software and Affected Versions: phpSysInfo versions 2.5.1 through 3.2.4 Description: The issue allows remote attackers to determine the existence of arbitrary files via a .. dot dot sequence and a trailing null %00 byte in the lng parameter. This will display a different...
CVE-2006-1715
The CVE-2006-1715 entry concerns Christian Kindahl TugZip (versions 3.4.0.0, 3.3.0.0, 3.1.0.2). The vulnerability arises in archive extraction where a dot-dot (..) path in a crafted archive pack (formats: .gz, .jar, .rar, or .zip) can lead to directory traversal, enabling a user‑assisted attacker...
DbbS<=2.0-alpha SQL injection
author: DaBDouB-MoSiKaR Moroccan Security Team site: http://www.dbbs.sup.fr/ greetz to : Moroccan Security Team CiM-TeaM and All Freinds exemple: http://target/topics.php?fid=3&limite=sql inbox:DaBDouB-MoSiKaRatmoroccan-securitydotcom...
DEBIAN-CVE-2006-0950
unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." dot dot sequences in a filename...
CVE-2006-0950
unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." dot dot sequences in a filename...
tar archive path traversal issue
The original patch for a GNU tar directory traversal vulnerability CVE-2002-0399 in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/"...
security flaw
Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream with 1 a large "number of components" value that is not checked by...
CVE-2002-2131
Directory traversal vulnerability in Perl-HTTPd before 1.0.2 allows remote attackers to view arbitrary files via a .. dot dot in an unknown argument...
security flaw
wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a redirection URL containing a ".." that resolves to the IP address of the malicious server, which bypasses wget's filtering for ".." sequences...
DEBIAN-CVE-2005-2874
The ispathabsolute function in scheduler/client.c for the daemon in CUPS before 1.1.23 allows remote attackers to cause a denial of service CPU consumption by tight loop via a "...." URL in an HTTP request...
VisualBoyAdvanced 1.7.x Local Shell Exploit (non suid) (updated)
No description provided by source. / VisualBoyAdvanced 1.7.x BufferOver Flow exploit VBA - WEBSITE : vba.ngemu.com Found & coded by Qnix - Qnixatbsdmaildotorg / include stdlib.h char shellcode = "\x31\xc0\x31\xdb\xb0\x17\xcd\x80" / setuid /...
CVE-2002-1857
jo! jo Webserver 1.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot "WEB-INF."...
CVE-2002-1855
Macromedia JRun 3.0 through 4.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot "WEB-INF."...
Mandrake Linux Security Advisory : wget (MDKSA-2005:098)
Two vulnerabilities were found in wget. The first is that an HTTP redirect statement could be used to do a directory traversal and write to files outside of the current directory. The second is that HTTP redirect statements could be used to overwrite dot '.' files, potentially overwriting the...
CVE-2005-1659
Cross-site scripting XSS vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to inject arbitrary Javascript via a URL with a "..." triple dot followed by an onmouseover event...