Safari vulnerable to local file content disclosure

Overview Safari contains a vulnerability where a local file may be accessed from remote, which may result in a local file content disclosure. Masahiro YAMADA reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact B...

CVE-2012-3380

Directory traversal vulnerability in naxsi-ui/nxextract.py in the Naxsi module before 0.46-1 for Nginx allows local users to read arbitrary files via unspecified vectors...

XML Vulnerability in Confluence

We have identified and fixed a vulnerability in Confluence that results from the way third-party XML parsers are used in Confluence. This vulnerability allows an attacker to: Execute denial of service attacks against the Confluence server, or Read all local files readable to the system user under...

Opera < 11.61 Multiple Vulnerabilities

The version of Opera installed on the remote Windows host is earlier than 11.61 and is, therefore, potentially affected by multiple vulnerabilities : - Same-origin policy restriction can be bypassed via specially crafted web content and HTML frames manipulation. Issue 1007 - An error in local fil...

FiberHome HG-110 - Cross-Site Scripting Directory Traversal

FiberHome HG-110 - Cross-Site Scripting Directory Traversal source: https://www.securityfocus.com/bid/47277/info Fiberhome HG-110 is prone to a cross-site scripting vulnerability and a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting thes...

Calibre 0.7.34 - Cross-Site Scripting / Directory Traversal

source: https://www.securityfocus.com/bid/45532/info Calibre is prone to a cross-site scripting vulnerability and a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting these issues will allow an attacker to execute arbitrary script code in t...

data: URL meta refresh (MFSA 2010-79)

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle certain redirections involving data: URLs and Java LiveConnect scripts, which allows remote attackers to start processes, read arbitrary local files, and establish network connections via...

pam: pam_xauth missing return value checks from setuid() and similar calls

The runcoprocess function in pamxauth.c in the pamxauth module in Linux-PAM aka pam before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pamxauth PAM check...

eLouai's Force Download Script Arbitrary Local File Download

Exploit for php platform in category web applications ============================================================ eLouai's Force Download Script Arbitrary Local File Download ============================================================...

Splunk Cross Site Scripting and Directory Traversal Vulnerabilities

Splunk is prone to multiple cross-site scripting vulnerabilities and multiple directory-traversal vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user i...

Mini Web Server Cross Site Scripting and Directory Traversal Vulnerabilities

Mini Web Server is prone to a directory-traversal vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the...

Adobe Flash Player 10.1.51 - Local File Access Information Disclosure

Adobe Flash Player 10.1.51 - Local File Access Information Disclosure source: https://www.securityfocus.com/bid/38517/info Adobe Flash Player is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further...

CVE-2010-0255

Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows remote attackers to bypass intended access restrictions and read arbitrary files via vectors involving JavaScript exploit code that constructs a reference to...

WebLogic 7.0.0.1 存在本地加密文件访问漏洞

No description provided by source...

openSUSE Security Update : MozillaFirefox (MozillaFirefox-509)

The Mozilla Firefox browser is updated to version 3.0.6 fixing various security and stability issues. MFSA 2009-01 / CVE-2009-0352 / CVE-2009-0353: Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these...

Mobilelib Gold 3 File Disclosure

|| || | || o,7 || . o7 || q||| o\, : / / . /QQQQQQQQQQQQQQQQQQQ\ /QQQ/\QQQ\ /QQQQQ/ \QQQQQQ\ /QQQQ/ QQQQ\ /QQQQ/ \QQQQ\ |QQQQ/ By Qabandi \QQQQ| |QQQQ| |QQQQ| |QQQQ| From Kuwait, PEACE... |QQQQ| |QQQQ| |QQQQ| |QQQQ\ iqaahotmail.fr /QQQQ| \QQQQ\ /QQQQ/ \QQQQ\ /QQ\QQQQ/ \QQQQ\ \QQQQQQQ/ \QQQQQ...

CVE-2009-1962

Xfig, possibly 3.2.5, allows local users to read and write arbitrary files via a symlink attack on the 1 xfig-epsPID, 2 xfig-picPID.pix, 3 xfig-picPID.err, 4 xfig-pcxPID.pix, 5 xfig-xfigrcPID, 6 xfigPID, 7 xfig-printPID, 8 xfig-exportPID.err, 9 xfig-batchPID, 10 xfig-expPID, or 11 xfig-spell.PID...

CVE-2009-1962

Xfig, possibly 3.2.5, allows local users to read and write arbitrary files via a symlink attack on the 1 xfig-epsPID, 2 xfig-picPID.pix, 3 xfig-picPID.err, 4 xfig-pcxPID.pix, 5 xfig-xfigrcPID, 6 xfigPID, 7 xfig-printPID, 8 xfig-exportPID.err, 9 xfig-batchPID, 10 xfig-expPID, or 11 xfig-spell.PID...

CVE-2009-1962

CVE-2009-1962 affects Xfig (likely 3.2.5) and allows local users to read/write arbitrary files via a symlink attack on temporary files named like xfig-eps[PID], xfig-pic[PID].pix/.err, xfig-pcx[PID].pix, xfig-xfigrc[PID], xfig[PID], xfig-print[PID], xfig-export[PID].err, xfig-batch[PID], xfig-exp...

CVE-2009-0783

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the 1 web.xml, 2 context.xml, or 3 tld files of arbitrary web applications via a crafted...