Trend Micro OfficeScan ofcscan.ini Configuration File Disclosure

The remote Trend Micro OfficeScan Corporate Edition Japanese version: Virus Buster Corporate Edition web-based management console allows unauthenticated access to files under '/officescan/hotdownload'. Reading the configuration file 'ofcscan.ini' under that location will reveal information about...

[ADVISORY]: Arbitrary file disclosure vulnerability in Sympoll 1.2

Sympoll is a customizable voting booth system written in PHP. A missing variable integrity check allows arbitrary files to be viewed on a web server that hosts Sympoll version 1.2. Hosts that have disabled the registerglobals directive in their php.ini file are not at risk. This vulnerability was...

Opera 6.0.1 Microsoft Internet Explorer 56 - JavaScript Modifier Keypress Event Subversion

Opera 6.0.1 Microsoft Internet Explorer 56 - JavaScript Modifier Keypress Event Subversion source: https://www.securityfocus.com/bid/5290/info An issue has been reported with the JavaScript implementation of multiple web browsers, including Microsoft Internet Explorer and Opera. Malicious...

Opera 6.0.1 / Microsoft Internet Explorer 5/6 - JavaScript Modifier Keypress Event Subversion

source: https://www.securityfocus.com/bid/5290/info An issue has been reported with the JavaScript implementation of multiple web browsers, including Microsoft Internet Explorer and Opera. Malicious JavaScript may subvert some keypress events, with consequences including the disclosure of arbitra...

Three BadBlue Vulnerabilities

Advisory: Working Resources BadBlue Multiple Vulnerabilities Issue: Three vulnerabilities; a denial of service, an insecurity in password storage, and a file disclosure vulnerability that could allow viewing of the password file. Risk: Critical SecurityFocus: "Working Resources BadBlue Invalid Ge...

iPlanet Web Server 4.1 - Search Component File Disclosure

iPlanet Web Server 4.1 - Search Component File Disclosure source: https://www.securityfocus.com/bid/5191/info The iPlanet Web Server search engine is prone to a file disclosure vulnerability. It is possible for remote attackers to make requests to the search engine which will cause arbitrary...

iPlanet Web Server 4.1 - Search Component File Disclosure

source: https://www.securityfocus.com/bid/5191/info The iPlanet Web Server search engine is prone to a file disclosure vulnerability. It is possible for remote attackers to make requests to the search engine which will cause arbitrary readable files on the host running the vulnerable software to ...

CVE-2002-0160: Undefined Security Weakness

The administration function in Cisco Secure Access Control Server ACS for Windows, 2.6.x and earlier and 3.x through 3.01 build 40, allows remote attackers to read HTML, Java class, and image files outside the web root via a .... modified .. in the URL to port 2002...

Wolfram Research webMathematica 4.0 - File Disclosure

Wolfram Research webMathematica 4.0 - File Disclosure source: https://www.securityfocus.com/bid/5035/info Wolfram Research's webMathematica is a Java based product which allows the inclusion of Mathematica content in a web environment. It includes CGI programs which generate image content based o...

Wolfram Research webMathematica 4.0 - File Disclosure

source: https://www.securityfocus.com/bid/5035/info Wolfram Research's webMathematica is a Java based product which allows the inclusion of Mathematica content in a web environment. It includes CGI programs which generate image content based on user supplied input. A file disclosure vulnerability...

My Postcards 6.0 - MagicCard.cgi Arbitrary File Disclosure

My Postcards 6.0 - MagicCard.cgi Arbitrary File Disclosure source: https://www.securityfocus.com/bid/5029/info My Postcards is a commercial available eletronic postcard system. It is available for Unix and Linux Operating Systems. The magiccard.cgi script does not properly handle some types of...

My Postcards 6.0 - 'MagicCard.cgi' Arbitrary File Disclosure

source: https://www.securityfocus.com/bid/5029/info My Postcards is a commercial available eletronic postcard system. It is available for Unix and Linux Operating Systems. The magiccard.cgi script does not properly handle some types of input. As a result, it may be possible for a remote user to...

Working Resources 1.7.3 BadBlue - Null Byte File Disclosure

Working Resources 1.7.3 BadBlue - Null Byte File Disclosure source: https://www.securityfocus.com/bid/5226/info BadBlue is a P2P file sharing application distributed by Working Resources. It is available for Microsoft Windows operating systems. It has been discovered that a request passed to a...

Working Resources 1.7.3 BadBlue - Null Byte File Disclosure

source: https://www.securityfocus.com/bid/5226/info BadBlue is a P2P file sharing application distributed by Working Resources. It is available for Microsoft Windows operating systems. It has been discovered that a request passed to a BadBlue server containing a null byte at the end of a file nam...

CVE-2002-0410

CVE-2002-0410 (AeroMail) affects AeroMail before 1.45. The vulnerability is in send_message.php, allowing remote attackers to read arbitrary server files instead of only uploaded ones by crafting the attachment filename during upload. This is caused by improper handling of file path/filename duri...

Seanox DevWex Windows Binary 1.2002.520 - File Disclosure

Seanox DevWex Windows Binary 1.2002.520 - File Disclosure source: https://www.securityfocus.com/bid/4978/info The Seanox DevWex Windows binary version is prone to an issue which may cause arbitrary web-readable files to be disclosed to remote attackers. This problem occurs because DevWex does not...

Seanox DevWex Windows Binary 1.2002.520 - File Disclosure

source: https://www.securityfocus.com/bid/4978/info The Seanox DevWex Windows binary version is prone to an issue which may cause arbitrary web-readable files to be disclosed to remote attackers. This problem occurs because DevWex does not sufficiently filter '..' sequences from web requests. GET...

QNX RTOS 4.25 - CRTTrap File Disclosure

QNX RTOS 4.25 - CRTTrap File Disclosure source: https://www.securityfocus.com/bid/4901/info The QNX RTOS crttrap binary includes a command-line option for specifying a configuration file. crttrap is installed setuid by default. crttrap Local attackers may specify an arbitrary system file in place...

QNX RTOS 4.25 - 'CRTTrap' File Disclosure

source: https://www.securityfocus.com/bid/4901/info The QNX RTOS crttrap binary includes a command-line option for specifying a configuration file. crttrap is installed setuid by default. crttrap Local attackers may specify an arbitrary system file in place of the configuration file and crttrap...

Gafware CFXImage 1.6.41.6.6 - ShowTemp File Disclosure

Gafware CFXImage 1.6.41.6.6 - ShowTemp File Disclosure source: https://www.securityfocus.com/bid/4882/info Gafware's CFXImage is a custom tag for ColdFusion. A program included with the CFXImage documentation doesn't properly filter its input. It is reported that a flaw exists in this program tha...