Nokia IPSO 3.4.x - Voyager ReadFile.TCL Remote File Reading

source: https://www.securityfocus.com/bid/7426/info It has been reported that Nokia IPSO does not properly handle some types of requests through Voyager. Because of this, an attacker with access to the interface may be able to view potentially sensitive information...

CVE-2002-1442

The Google toolbar 1.1.58 and earlier allows remote web sites to perform unauthorized toolbar operations including script execution and file reading in other zones such as "My Computer" by opening a window to tools.google.com or the res: protocol, then using script to modify the window's location...

CVE-2002-1039

Directory traversal vulnerability in Double Choco Latte DCL before 20020706 allows remote attackers to read arbitrary files via .. dot dot sequences when downloading files from the Projects: Attachments feature...

CVE-2002-1081

The Administration console for Abyss Web Server 1.0.3 allows remote attackers to read files without providing login credentials via an HTTP request to a target file that ends in a "+" character...

CVE-2002-1523

Directory traversal vulnerability in Daniel Arenz Mini Server 2.1.6 allows remote attackers to read arbitrary files via 1 ../ dot-dot slash or 2 ..\ dot-dot backslash sequences...

CVE-2000-0590

CVE-2000-0590 affects the Poll It 2.0 CGI script. The vulnerability allows a remote attacker to read arbitrary files by supplying a file name in the data_dir parameter, with an example showing access to /etc/passwd. OpenVAS/Nessus entries corroborate arbitrary file access via the CGI. Remediation...

CVE-2001-1334

Blockrenderurl.class in PHPSlash 0.6.1 allows remote attackers with PHPSlash administrator privileges to read arbitrary files by creating a block and specifying the target file as the source URL...

CVE-2002-1498

Directory traversal vulnerability in SWServer 2.2 and earlier allows remote attackers to read arbitrary files via a URL containing .. sequences with "/" or "" characters...

CVE-2002-1534

Macromedia Flash Player allows remote attackers to read arbitrary files via XML script in a .swf file that is hosted on a remote SMB share...

CVE-2003-0156

Directory traversal vulnerability in Cross-Referencing Linux LXR allows remote attackers to read arbitrary files via .. dot dot sequences in the v parameter...

CVE-2003-0156

The CVE-2003-0156 vulnerability affects Cross-Referencing Linux (LXR), specifically the CGI component handling the v parameter in the source page. The root cause is insufficient input sanitization, enabling a directory-traversal attack to read arbitrary files on the host. This is evidenced by Deb...

CVE-2003-0151

BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code...

CVE-2002-1498

The CVE-2002-1498 entry documents a directory traversal vulnerability in SWServer 2.2 and earlier. The issue arises when an attacker supplies a URL containing .. sequences along with "/" or "\" characters, allowing reading of arbitrary files on the server. The vulnerability affects SWServer’s han...

CVE-2002-1467

CVE-2002-1467 affects the Macromedia Flash Plugin prior to 6.0.47.0, allowing remote attackers to bypass the same-domain restriction and read arbitrary files via (1) HTTP redirects, (2) a file:// base in a web document, or (3) a relative URL from a web archive (mht). The primary sources in the pr...

CVE-2002-1442

The Google toolbar 1.1.58 and earlier allows remote web sites to perform unauthorized toolbar operations including script execution and file reading in other zones such as "My Computer" by opening a window to tools.google.com or the res: protocol, then using script to modify the window's location...

CVE-2002-1559

Directory traversal vulnerability in ion-p.exe aka ion-p allows remote attackers to read arbitrary files via 1 C: drive letter or 2 .. dot-dot sequences in the page parameter...

CVE-2003-0076

Unknown vulnerability in the directory parser for Direct Connect 4 Linux dcgui before 0.2.2 allows remote attackers to read files outside the sharelist...

CVE-2003-0027

Directory traversal vulnerability in Sun Kodak Color Management System KCMS library service daemon kcmsserver allows remote attackers to read arbitrary files via the KCSOPENPROFILE procedure...

CVE-2003-0043

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file...

CVE-2002-1252

The Application Messaging Gateway for PeopleTools 8.1x before 8.19, as used in various PeopleSoft products, allows remote attackers to read arbitrary files via certain XML External Entities XXE fields in an HTTP POST request that is processed by the SimpleFileHandler handler...