[UNIX] Sun Management Console Directory Traversal Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

CVE-2004-1927

Directory traversal vulnerability in the map feature tiki-map.phtml in Tiki CMS/Groupware TikiWiki 1.8.1 and earlier allows remote attackers to determine the existence of arbitrary files via .. dot dot sequences in the mapfile parameter...

Microsoft Internet Explorer 5.0.1 - LoadPicture File Enumeration

Microsoft Internet Explorer 5.0.1 - LoadPicture File Enumeration source: https://www.securityfocus.com/bid/9611/info Microsoft Internet Explorer is prone to an issue that may permit a remote site to enumerate the existence of files on the client system. This may be exploited via abuse of the...

Pablo FTP file existance information leak

It's possible to check file existance with DEL command...

CVE-2003-1413

parsexml.cgi in Apple Darwin Streaming Server 4.1.1 allows remote attackers to determine the existence of arbitrary files by using ".." sequences in the filename parameter and comparing the resulting error messages...

Syscall implementation could lead to whether or not a file exists

include stdlib.h include unistd.h include stdio.h include sys/types.h include fcntl.h ifndef ONOFOLLOW define ONOFOLLOW 0400000 / don't follow links / endif ifndef OLARGEFILE define OLARGEFILE 0100000 endif int flags = ORDONLY|OEXCL|OSYNC|ONOCTTY|ONOFOLLOW; / taken from scuts format string...

Syscall timing attacks in multiple systems

By timing system calls it's possible to check file existance...

Linux Kernel 2.2.x2.4.x - IO System Call File Existence

Linux Kernel 2.2.x2.4.x - IO System Call File Existence / source: https://www.securityfocus.com/bid/7279/info A weakness has been discovered on various systems that may result in an attacker gaining information pertaining to the existence of inaccessible files. The problem lies in the return time...

Linux Kernel 2.2.x/2.4.x - I/O System Call File Existence

/ source: https://www.securityfocus.com/bid/7279/info A weakness has been discovered on various systems that may result in an attacker gaining information pertaining to the existence of inaccessible files. The problem lies in the return times when attempting to access existent and non-existent...

CVE-2002-0594

CVE-2002-0594 affects Netscape 6 and Mozilla 1.0 RC1 and earlier. A CSS LINK element that triggers an HTTP redirect can let remote attackers determine the existence of local files, exposing partial confidentiality. The CVSS v2 base score is 5.0 (Network, Low complexity, No user interaction). Red ...

CVE-2002-1339

CVE-2002-1339 affects the Spreadsheet component of Office Web Components (OWC) 10. The XMLURL property follows redirections, enabling remote attackers to infer the existence of local files from error responses or to read Worksheet XML files. The provided sources confirm the vulnerability descript...

CVE-2002-1338

The Load method in the Chart component of Office Web Components OWC 9 and 10 generates an exception when a specified file does not exist, which allows remote attackers to determine the existence of local files...

SUIDPerl 5.6 - Information Disclosure

source: https://www.securityfocus.com/bid/6282/info An information disclosure vulnerability has been reported for SuidPerl. Reportedly, it is possible for an attacker to determine whether files exist in non-accessible directories. An attacker can exploit this vulnerability by invoking suidperl wi...

SUIDPerl 5.6 - Information Disclosure

SUIDPerl 5.6 - Information Disclosure source: https://www.securityfocus.com/bid/6282/info An information disclosure vulnerability has been reported for SuidPerl. Reportedly, it is possible for an attacker to determine whether files exist in non-accessible directories. An attacker can exploit this...

Microsoft Office Web Components allows arbitary user to determine whether local file exists via Chart component "Load" method

Overview Microsoft Office Web Components OWC allows a malicious script on a web page to learn if a file exists on the client's filesystem. Description OWC allows viewing of Microsoft Office documents such as spreadsheets and charts to be viewed within an HTML document in Microsoft Internet Explor...

CVE-2002-0500

Internet Explorer 5.0 through 6.0 allows remote attackers to determine the existence of files on the client via an IMG tag with a dynsrc property that references the target file, which sets certain elements of the image object such as file size...

Serious IE privacy issues

In addition to "Minor IE System Info Disclosure" Nov 4 2001 I've found that you can further poll a system for ANY file, provided you know it's path. Use the following script: html head script language="javascript" !-- var fileExists = false; function yes alert"the file exists."; yes = true;...

CVE-1999-1110

Windows Media Player ActiveX object as used in Internet Explorer 5.0 returns a specific error code when a file does not exist, which allows remote malicious web sites to determine the existence of files on the client...

CVE-1999-1225

rpc.mountd on Linux, Ultrix, and possibly other operating systems, allows remote attackers to determine the existence of a file on the server by attempting to mount that file, which generates different error messages depending on whether the file exists or not...

CVE-1999-1496

Sudo 1.5 in Debian Linux 2.1 and Red Hat 6.0 allows local users to determine the existence of arbitrary files by attempting to execute the target filename as a program, which generates a different error message when the file does not exist...