CVE-2011-0776

The sandbox implementation in Google Chrome before 9.0.597.84 on Mac OS X might allow remote attackers to obtain potentially sensitive information about local files via vectors related to the stat system call...

ReOS Local File Include and SQL Injection Vulnerabilities

ReOS is prone to a local file-include vulnerability and multiple SQL- injection vulnerabilities because it fails to properly sanitize user- supplied input. An attacker can exploit the local file-include vulnerability using directory- traversal strings to view and execute arbitrary local files...

PT-2011-2625

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 9.0.597.84 Description The issue in Google Chrome might allow remote attackers to obtain potentially sensitive information about local files via vectors related to the stat system call. Recommendations For...

CVE-2011-0684

Opera before 11.01 does not properly handle redirections and unspecified other HTTP responses, which allows remote web servers to obtain sufficient access to local files to use these files as page resources, and consequently obtain potentially sensitive information from the contents of the files,...

CVE-2011-0684

Opera before 11.01 does not properly handle redirections and unspecified other HTTP responses, which allows remote web servers to obtain sufficient access to local files to use these files as page resources, and consequently obtain potentially sensitive information from the contents of the files,...

Web pages can gain limited access to files on the user’s computer – Opera Security Advisories

Web pages can gain limited access to files on the user’s computer – Opera Security Advisories OPCOM Team | January 25, 2011 Severity High Description Certain types of HTTP responses and redirections can cause Opera to mistakenly give elevated privileges to remote web pages. These pages can then u...

CVE-2011-0505

Directory traversal vulnerability in system/system.php in Zwii 2.1.1, when magicquotesgpc is disabled and registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the settemplatevalue parameter...

Directory traversal

Directory traversal vulnerability in system/system.php in Zwii 2.1.1, when magicquotesgpc is disabled and registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the settemplatevalue parameter...

Code injection

The validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted dataTokenfields value that is processed by the unserialize function, as demonstrated by...

CVE-2010-4350

Directory traversal vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...

Directory traversal

Directory traversal vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...

PT-2011-1513

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.4 Description The issue is related to a directory traversal vulnerability. It allows remote attackers to include and execute arbitrary local files via a .. dot dot in the db type parameter. This is due to an unsa...

CVE-2010-4613

Multiple directory traversal vulnerabilities in Hycus CMS 1.0.3 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the site parameter to 1 index.php and 2 admin.php...

CVE-2010-4613

Multiple directory traversal vulnerabilities in Hycus CMS 1.0.3 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the site parameter to 1 index.php and 2 admin.php...

CVE-2010-4613

Hycus CMS 1.0.3 is affected by a Local File Include vulnerability (CVE-2010-4613). The issue arises from insufficient sanitization of the site parameter in index.php and admin.php, allowing remote attackers to include local files via directory traversal sequences (e.g., ../../) and NULL-byte tric...

WordPress Plugin Mediatricks Viva Thumbs - Multiple Information Disclosure Vulnerabilities

WordPress Plugin Mediatricks Viva Thumbs - Multiple Information Disclosure Vulnerabilities source: https://www.securityfocus.com/bid/45539/info The Mediatricks Viva Thumbs plugin for WordPress is prone to multiple information-disclosure vulnerabilities because it fails to properly sanitize...

Calibre 0.7.34 - Cross-Site Scripting Directory Traversal

Calibre 0.7.34 - Cross-Site Scripting Directory Traversal source: https://www.securityfocus.com/bid/45532/info Calibre is prone to a cross-site scripting vulnerability and a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting these issues wi...

CVE-2010-3775

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle certain redirections involving data: URLs and Java LiveConnect scripts, which allows remote attackers to start processes, read arbitrary local files, and establish network connections via...

Java security bypass from LiveConnect loaded via data: URL meta refresh — Mozilla

Security researcher Gregory Fleischer reported that when a Java LiveConnect script was loaded via a data: URL which redirects via a meta refresh, then the resulting plugin object was created with the wrong security principal and thus received elevated privileges such as the abilities to read loca...

PT-2010-5063

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.5.16 Mozilla Firefox versions 3.6.x prior to 3.6.13 SeaMonkey versions prior to 2.0.11 Description The issue arises from improper handling of certain redirections involving data: URLs and Java LiveConnect...