The vulnerability of the Security SiteProtector System, a website security protection system, allows a hacker to write arbitrary files.

The vulnerability of the Security SiteProtector System’s security protection mechanism exists due to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability allows a malicious actor to remotely write arbitrary files...

PI Engine Arbitrary File Read Vulnerability

PI Engine is an open source CMS system. The /browser.php page of PI Engine is used to provide file browsing functionality, which has flaws in checking file types and also does not correctly restrict file paths, allowing attackers to construct paths to access files in any directory...

chromium-browser: android downloaded file path restriction bypass

The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors...

The vulnerability of the Debian GNU/Linux operating system, which allows a hacker to read arbitrary files

The vulnerability of the wiki.c function in DidiWiki’s kernel is related to deficiencies in pathname restrictions for the catalog. Exploiting this vulnerability could allow a malicious actor to read arbitrary files through the api/page/get parameter...

The vulnerability in the web application for data synchronization with ownCloud allows a hacker to read the list of directory contents or cause a service failure.

The vulnerability of the web application for syncing data with ownCloud exists due to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to read the content of the directories or cause service failures by manipulating the...

ZTE ZXHN H108N R1A Arbitrary File Read Vulnerability

The ZTE ZXHN H108N R1A is a wireless router product from China's ZTE Corporation. The webproc cgi module in ZTE ZXHN H108N R1A ZTE.bhs.ZXHNH108NR1A.hPE fails to properly restrict Restricted Directory pathnames, which allows remote attackers to exploit the vulnerability to read arbitrary files on...

The vulnerability of the Moodle learning management system allows a hacker to access and read arbitrary files.

The vulnerability of the mingetslashargument function in the lib/configonlylib.php component of the Moodle learning management system exists due to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to read arbitrary files...

The vulnerability of the NetCharts Server data visualization platform allows a hacker to write arbitrary files.

The vulnerability in the saveFile.jsp file of the NetCharts Server deployment tool exists due to an incorrect restriction on the path name for the restricted access directory. Exploiting this vulnerability allows a malicious actor to write any files they desire...

[SECURITY] [DLA 202-1] wesnoth-1.8 security update

Package : wesnoth-1.8 Version : 1:1.8.5-1+deb6u1 CVE ID : CVE-2015-0844 Ignacio R. Morelle discovered that missing path restrictions in the "Battle of Wesnoth" game could result in the disclosure of arbitrary files in the users home directory if malicious campaigns/maps are loaded. For the...

Debian: Security Advisory (DSA-3218-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Multiple Vulnerabilities in UberFire Framework

UberFire Framework is a rich client platform architecture software. The software supports high-availability deployments. An arbitrary code execution and file read vulnerability exists in UberFire Framework version 0.3.x, which stems from the program failing to properly restrict paths. A remote...

CVE-2014-8114

The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to 1 execute arbitrary code by uploading crafted content to FileUploadServlet or 2 read arbitrary files via vectors involving FileDownloadServlet...

CVE-2014-8114

The CVE-2014-8114 entry affects the UberFire Framework 0.3.x and is caused by inadequate path restriction in the framework’s FileUploadServlet/FileDownloadServlet handling. This leads to two disclosed risks: (1) remote code execution by uploading crafted content to FileUploadServlet and (2) arbit...

CVE-2013-3426

The Serviceability servlet on Cisco 9900 IP phones does not properly restrict paths, which allows remote attackers to read arbitrary files by specifying a pathname in a file request, aka Bug ID CSCuh52810...

Microsoft Windows Multiple COM Binary Planting Vulnerabilities (MS11-076; CVE-2011-1991; CVE-2011-2009)

The vulnerabilities are due to the way Windows COM servers improperly restrict the paths used when loading external libraries. A remote attacker may exploit these vulnerabilities by enticing an unsuspecting user to open a specially crafted file from a WebDAV or an SMB shareSuccessful exploitation...

Debian Security Advisory DSA 459-1 (kdelibs, kdelibs-crypto)

The remote host is missing an update to kdelibs, kdelibs-crypto announced via advisory DSA 459-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

CVE-2006-6383

PHP 5.2.0 and 4.4 allows local users to bypass safemode and openbasedir restrictions via a malicious path and a null byte before a ";" in a sessionsavepath argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.savepath...

PT-2004-1119 · Unarj · Unarj

Name of the Vulnerable Software and Affected Versions: unarj affected versions not specified Description: The issue is related to a directory traversal vulnerability in the -x extract command line option. This vulnerability allows remote attackers to overwrite arbitrary files by using an arj...

Mandrake Linux Security Advisory : kdelibs (MDKSA-2004:022)

Corsaire discovered that a number of HTTP user agents contained a flaw in how they handle cookies. This flaw could allow an attacker to avoid the path restrictions specified by a cookie's originator. According to their advisory : 'The cookie specifications detail a path argument that can be used ...

Apple Safari 1.x - Cookie Directory Traversal

source: https://www.securityfocus.com/bid/9841/info Multiple vendor Internet Browsers have been reported to be prone to a cookie path argument restriction bypass vulnerability. The issue presents itself due to a failure to properly sanitize encoded URI content, this may make it possible for an...