Security bypass of PDF.js checks using iframes — Mozilla

Security researcher Cody Crews discovered a method to append an iframe into an embedded PDF object rendered with the chrome privileged PDF.js. This can used to bypass security restrictions to load local or chrome privileged files and objects within the embedded PDF object. This can lead to...

CVE-2013-5692

Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the file parameter to index.php/admin/translationManager...

Directory traversal

Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the file parameter to index.php/admin/translationManager...

CVE-2013-5692

Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the file parameter to index.php/admin/translationManager...

Same-origin bypass through symbolic links — Mozilla

Security researcher Takeshi Terada reported a mechanism to violate same-origin policy for local files using file:// through the use of symbolic links. This problem only affects web pages loaded from the local filesystem. This could allow for cross-site scripting XSS and access to locally stored...

Microsoft Office Remote Code Execution Vulnerabilities (2858300) - Mac OS X

This host is missing an important security update according to Microsoft Bulletin MS13-073. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Ubuntu Update for thunderbird USN-1925-1

Check for the Version of thunderbird OpenVAS Vulnerability Test $Id: gbubuntuUSN19251.nasl 8542 2018-01-26 06:57:28Z teissa $ Ubuntu Update for thunderbird USN-1925-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

Mozilla: Local Java applets may read contents of local file system (MFSA 2013-75)

Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly restrict local-filesystem access by Java applets, which allows user-assisted remote attackers to read arbitrary files by leveraging...

USN-1925-1: Thunderbird vulnerabilities

Jeff Gilbert and Henrik Skupin discovered multiple memory safety issues in Thunderbird. If the user were tricked in to opening a specially crafted message with scripting enabled, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute...

KLA10188 Multiple vulnerabilities in HP Insight Diagnostics

Multiple critical vulnerabilities have been found in HP Insight Diagnostics. Malicious users can exploit these vulnerabilities to inject code or write local files. Below is a complete list of vulnerabilities 1. Improper PHP include restrictions can be exploited via a path parameter; 2. A path...

Multiple DVR HTTP Server Directory Traversal Vulnerability - Active Check

The thttpd running on the remote DVR is prone to a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

Acme thttpd HTTP Server - Directory Traversal

source: https://www.securityfocus.com/bid/60010/info thttpd is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue will allow an attacker to view arbitrary local files within the context of the web server. Information...

Server: Multiple directory traversals

Multiple directory traversal vulnerabilities in 1 apps/filestrashbin/index.php via the "dir" GET parameter and 2 lib/files/view.php via undefined vectors in all ownCloud versions prior to 5.0.6 and other versions before 4.0.15, allow authenticated remote attackers to get access to arbitrary local...

Apache mod_security security vulnerabilities

Local files access, resources exhausiton...

Sophos Web Protection Appliance multiple security vulnerabilities

Local files access, commands executions, crossite scripting...

Directory traversal

Directory traversal vulnerability in DUSAP.php in Novell ZENworks Mobile Management before 2.7.1 allows remote attackers to include and execute arbitrary local files via the language parameter...

CVE-2013-1082

Directory traversal vulnerability in DUSAP.php in Novell ZENworks Mobile Management before 2.7.1 allows remote attackers to include and execute arbitrary local files via the language parameter...

CVE-2013-1082

Novell ZENworks Mobile Management (ZMM) DUSAP.php is vulnerable to a directory traversal-based local file inclusion (LFI) via the language parameter, allowing remote unauthenticated attackers to include and execute arbitrary local files. The issue affects ZMM versions 2.7.0 and 2.6.1 (likely earl...

CVE-2013-1081

Directory traversal vulnerability in MDM.php in Novell ZENworks Mobile Management ZMM 2.6.1 and 2.7.0 allows remote attackers to include and execute arbitrary local files via the language parameter...

Directory traversal

Directory traversal vulnerability in MDM.php in Novell ZENworks Mobile Management ZMM 2.6.1 and 2.7.0 allows remote attackers to include and execute arbitrary local files via the language parameter...