3333 matches found
CVE-2009-1715
Cross-site scripting XSS vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to script execution with incorrect privileges...
CVE-2009-1714
Cross-site scripting XSS vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to the improper escaping of HTML attributes...
CVE-2009-1715: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to script execution with incorrect privileges...
CVE-2009-1713
The XSLT functionality in WebKit in Apple Safari before 4.0 does not properly implement the document function, which allows remote attackers to read 1 arbitrary local files and 2 files from different security zones via unspecified vectors...
[Full-disclosure] CORE-2008-0826 - Internet Explorer Security Zone restrictions bypass
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Internet Explorer Security Zone restrictions bypass 1. Advisory Information Title: Internet Explorer Security Zone restrictions bypass Advisory ID: CORE-2008-0826...
Microsoft Internet Explorer 5.0.1 - Cached Content Cross Domain Information Disclosure
Microsoft Internet Explorer 5.0.1 - Cached Content Cross Domain Information Disclosure source: https://www.securityfocus.com/bid/35200/info Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability because the application fails to properly enforce the same-origin...
Worldweaver DX Studio Player shell.execute() Command Execution
This module exploits a command execution vulnerability within the DX Studio Player from Worldweaver for versions 3.0.29 and earlier. The player is a browser plugin for IE ActiveX and Firefox dll. When an unsuspecting user visits a web page referring to a specially crafted .dxstudio document, an...
CVE-2009-1960
inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via the configcascademaindefault parameter to doku.php. NOTE: PHP remote file inclusion is also possible in PHP 5 using ftp://...
CVE-2009-1912
Directory traversal vulnerability in src/func/language.php in webSPELL 4.2.0e and earlier allows remote attackers to include and execute arbitrary local .php files via a .. dot dot in a language cookie. NOTE: this can be leveraged for SQL injection by including awards.php...
CVE-2009-1846
Multiple directory traversal vulnerabilities in SiteX 0.7.4 Build 418 and earlier allow remote attackers to include and execute arbitrary local files via a .. dot dot in the THEMEFOLDER parameter to 1 Corporate/homepage.php, 2 Fusion/homepage.php, 3 Joombo/homepage.php, 4 Streamline/homepage.php,...
CVE-2009-1846
Multiple directory traversal vulnerabilities in SiteX 0.7.4 Build 418 and earlier allow remote attackers to include and execute arbitrary local files via a .. dot dot in the THEMEFOLDER parameter to 1 Corporate/homepage.php, 2 Fusion/homepage.php, 3 Joombo/homepage.php, 4 Streamline/homepage.php,...
horde-base -- multiple vulnerabilities
The Horde team reports: An error within the form library when handling image form fields can be exploited to overwrite arbitrary local files. An error exists within the MIME Viewer library when rendering unknown text parts. This can be exploited to execute arbitrary HTML and script code in a user...
CVE-2009-1770
Directory traversal vulnerability in includes/database/examples/addressbook.php in Flyspeck CMS 6.8 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...
Directory traversal
Directory traversal vulnerability in plugins/ddb/foot.php in Strawberry 1.1.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the file parameter to example/index.php. NOTE: this was originally reported as an issue affecting the do parameter, but traversal...
Directory traversal
Multiple directory traversal vulnerabilities in pluck 4.6.2, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the langpref parameter to 1 data/modules/contactform/moduleinfo.php, 2 data/modules/blog/moduleinfo.php, and 3...
CVE-2009-1774
Directory traversal vulnerability in plugins/ddb/foot.php in Strawberry 1.1.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the file parameter to example/index.php. NOTE: this was originally reported as an issue affecting the do parameter, but traversal...
CVE-2009-1765
Multiple directory traversal vulnerabilities in pluck 4.6.2, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the langpref parameter to 1 data/modules/contactform/moduleinfo.php, 2 data/modules/blog/moduleinfo.php, and 3...
Zervit Webserver multiple vulnerabilities
According to its version number, the remote version of Zervit HTTP server is prone to a remote buffer-overflow vulnerability and to a directory-traversal vulnerability. An attacker can exploit the remote buffer-overflow issue to execute arbitrary code within the context of the affected applicatio...
Directory traversal
Directory traversal vulnerability in index.php in Thickbox Gallery 2 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ln parameter...