11671 matches found
Path traversal
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This...
CVE-2023-22380 Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This...
CVE-2023-22380 Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This...
CVE-2023-22380
CVE-2023-22380 describes a path traversal vulnerability in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. The issue affects all versions of GitHub Enterprise Server since 3.7 and is due to a flaw in the file-path handling during Page builds, enabli...
SUSE CVE-2002-2437
The JavaScript implementation in Mozilla Firefox before 4.0, Thunderbird before 3.3, and SeaMonkey before 2.1 does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited w...
SUSE CVE-2004-1059
Multiple cross-site scripting XSS vulnerabilities in mnoGoSearch 3.2.26 and earlier allow remote attackers to inject arbitrary HTML and web script via the 1 next and 2 prev result search pages, and the 3 extended and 4 simple search forms...
SUSE CVE-2005-0916
AIO in the Linux kernel 2.6.11 on the PPC64 or IA64 architectures with CONFIGHUGETLBPAGE enabled allows local users to cause a denial of service system panic via a process that executes the ioqueueinit function but exits without running ioqueuerelease, which causes exitaio and ishugepageonlyrange...
SUSE CVE-2005-1158
Multiple "missing security checks" in Firefox before 1.0.3 allow remote attackers to inject arbitrary Javascript into privileged pages using the search target of the Firefox sidebar...
SUSE CVE-2005-2706
Firefox before 1.0.7 and Mozilla before Suite 1.7.12 allows remote attackers to execute Javascript with chrome privileges via an about: page such as about:mozilla...
SUSE CVE-2005-3424
Cross-site scripting XSS vulnerability in GNUMP3D before 2.9.5 allows remote attackers to inject arbitrary web script or HTML via 404 error pages, a different vulnerability than CVE-2005-3425...
SUSE CVE-2005-3808
Integer overflow in the invalidateinodepages2range function in mm/truncate.c in Linux kernel 2.6.11 to 2.6.14 allows local users to cause a denial of service hang via 64-bit mmap calls that are not properly handled on a 32-bit system...
SUSE CVE-2006-2783
Mozilla Firefox and Thunderbird before 1.5.0.4 strip the Unicode Byte-order-Mark BOM from a UTF-8 page before the page is passed to the parser, which allows remote attackers to conduct cross-site scripting XSS attacks via a BOM sequence in the middle of a dangerous tag such as SCRIPT...
SUSE CVE-2006-6077
The 1 Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the 2 Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a...
SUSE CVE-2007-0104
The Adobe PDF specification 1.3, as implemented by a xpdf 3.0.1 patch 2, b kpdf in KDE before 3.5.5, c poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service infinite loop, arbitrary code execution, or memory corruption, v...
SUSE CVE-2007-6522
The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks by using designMode to modify contents of pages in other domains...
SUSE CVE-2008-1380
The JavaScript engine in Mozilla Firefox before 2.0.0.14, Thunderbird before 2.0.0.14, and SeaMonkey before 1.1.10 allows remote attackers to cause a denial of service garbage collector crash and possibly have other impacts via a crafted web page. NOTE: this is due to an incorrect fix for...
SUSE CVE-2008-2372
The Linux kernel 2.6.24 and 2.6.25 before 2.6.25.9 allows local users to cause a denial of service memory consumption via a large number of calls to the getuserpages function, which lacks a ZEROPAGE optimization and results in allocation of "useless newly zeroed pages."...
SUSE CVE-2008-2402
The Admin Server in Sun Java Active Server Pages ASP Server before 4.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read password hashes and configuration data via direct requests for unspecified documents...
SUSE CVE-2008-2404
Stack-based buffer overflow in the request handling implementation in Sun Java Active Server Pages ASP Server before 4.0.3 allows remote attackers to execute arbitrary code via an unspecified string field...