[Full-disclosure] HP eSupportDiagnostics hpediags.dll Information Disclosure

The HP eSupportDiagnostics hpediag.dll exposes some methods that allow the reading of arbitrary files and registry values. hpediag.dll, version 1.0.11.0 PoC as follows: --------------------- html head script language="JavaScript" DEFER function Check var out = fileUtil.ReadTextFilesomePath; var o...

CVE-2007-6187

Multiple directory traversal vulnerabilities in PHP Content Architect aka NoAh 0.9 pre 1.2 and earlier allow remote attackers to read arbitrary files via a .. dot dot in the filepath parameter to 1 cssfile.php, 2 jsfile.php, or 3 xmlfile.php in noah/modules/nosystem/templates/...

CVE-2007-5811

CVE-2007-5811 affects phpMyConferences up to version 8.0.2, specifically the PageTraiteDownload.php component. The vulnerability is a directory traversal via the dir parameter (..), allowing reads of arbitrary files. The issue is disputed for 8.0.2 by a third party who notes the PHP code may be s...

CVE-2007-5337

Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5, when running on Linux systems with gnome-vfs support, might allow remote attackers to read arbitrary files on SSH/sftp servers that accept key authentication by creating a web page on the target server, in which the web page contains URIs...

Design/Logic Flaw

ioncubeloaderwin5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safemode and disablefunctions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by reading arbitrary files via the ioncubereadfile function...

CVE-2007-5447

ioncubeloaderwin5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safemode and disablefunctions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by reading arbitrary files via the ioncubereadfile function...

CVE-2007-5447

CVE-2007-5447 affects ionCube Loader 6.5 for PHP 5.2.4. The ioncube_loader_win_5.2.dll does not enforce safe_mode or disable_functions, enabling context-dependent attackers to read arbitrary files via ioncube_read_file. This vulnerability is documented in the NVD entry for CVE-2007-5447 and is ec...

CVE-2007-5299

Multiple directory traversal vulnerabilities in SkaDate 5.0 and 6.0, and possibly later versions such as 6.482, allow remote attackers to read arbitrary files via a .. dot dot in the viewmode parameter to 1 featuredlist.php and 2 onlinelist.php in member/...

CVE-2007-4726

Web Oddity 0.09b contains a directory traversal vulnerability that lets remote attackers read arbitrary files via a .. in the request URI. The available documents identify the affected product and the vulnerability class but do not provide remediation steps. Exploitation details or patches are no...

EUVD-2007-3241

Multiple directory traversal vulnerabilities in e-Vision CMS 2.02 and earlier allow remote attackers to 1 include and execute arbitrary local files via a .. dot dot in the adminlang cookie to admin/functions.php or 2 read arbitrary local files via the img parameter to admin/showimg.php...

Firefox 0day local file reading

Firefox 0day local file reading By Thor Larholm RSnake mentioned a potential way to read security sensitive configuration settings from Firefox on ha.ckers.org, with an example PoC from Sergey Vzloman that used the resource:// URL protocol handler in Firefox. Unfortunately, the settings that were...

EUVD-2007-2435

Directory traversal vulnerability in Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to read certain files via a .. dot dot in a URI containing a "\web-inf" sequence...

CVE-2007-2440

Directory traversal vulnerability in Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to read certain files via a .. dot dot in a URI containing a "\web-inf" sequence...

Design/Logic Flaw

picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter...

CVE-2007-2369

CVE-2007-2369 affects WebSPELL up to version 4.01.02 (and earlier) where Picture.php is vulnerable when PHP

Design/Logic Flaw

The readfile function in PHP 4.4.4, 5.1.6, and 5.2.1 allows context-dependent attackers to bypass safemode restrictions and read arbitrary files by referring to local files with a certain URL syntax instead of a pathname syntax, as demonstrated by a filename preceded a "php://../../" sequence...

fizzle-access.txt

Fizzle allows feeds to use HTML in feed data resulting in JavaScript being run in the chrome: window with chrome permissions. The extension will convert HTML entities back to their ASCII equivalents thus for formatting to lose their layout I told him it would be too difficult to sanitize the data...

Fizzle : Firefox Extension Vulnerability

Fizzle allows feeds to use HTML in feed data resulting in JavaScript being run in the chrome: window with chrome permissions. The extension will convert HTML entities back to their ASCII equivalents thus becomes and so forth. Various feeds fields are vulnerable including the title which allows th...

Fizzle 0.5 - RSS Feed HTML Injection

source: https://www.securityfocus.com/bid/23144/info Fizzle is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would run in the context of the...

Fedora Core 6 : xen-3.0.3-8.fc6 (2007-343)

A flaw was found affecting the VNC server code in QEMU. On a fully virtualized guest VM, where qemu monitor mode is enabled, a user who had access to the VNC server could gain the ability to read arbitrary files as root in the host filesystem. CVE-2007-0998 Note that Tenable Network Security has...