UBUNTU-CVE-2016-5279

Mozilla Firefox before 49.0 allows user-assisted remote attackers to obtain sensitive full-pathname information during a local-file drag-and-drop operation via crafted JavaScript code...

USN-3024-1: Tomcat vulnerabilities

It was discovered that Tomcat incorrectly handled pathnames used by web applications in a getResource, getResourceAsStream, or getResourcePaths call. A remote attacker could use this issue to possibly list a parent directory . This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu...

CVE-2016-0304

The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, aka SPR KLYHA7MM3J...

CVE-2016-0304: Improper Access Control

The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, aka SPR KLYHA7MM3J...

PT-2016-4136

Name of the Vulnerable Software and Affected Versions IBM Domino versions 8.5.x through 8.5.3 FP6 IF12 and versions 9.x through 9.0.1 FP5 Description The Java Console in IBM Domino, when used with a certain unsupported configuration involving UNC share pathnames, allows remote attackers to bypass...

DEBIAN-CVE-2016-1583

The ecryptfsprivilegedopen function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service stack memory consumption via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling...

Code injection

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls 1 a DOMDocument load method, 2 the xmlwriteropenuri function, 3 t...

EMC Unisphere for VMAX vApp Manager Arbitrary File Write Vulnerability

EMC Unisphere for VMAX is a set of management interfaces for the VMAX storage family from EMC Corporation USA. An arbitrary file write vulnerability exists in the HTTP servlet in vApp Manager in EMC Unisphere for VMAX versions prior to 8.2.0, which can be exploited by a remote attacker to write...

Design/Logic Flaw

The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors...

CVE-2015-7934

The CVE-2015-7934 entry concerns the Adcon Telemetry A840 Telemetry Gateway Base Station’s Java client, where the Java client reveals the full pathname of log files on the server. The vulnerability is an information disclosure (log-file pathnames) that could be exploited remotely, with no client ...

CVE-2015-7934

The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors...

CVE-2015-7934: Exposure of Sensitive Information to an Unauthorized Actor

The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors...

PT-2015-7679

Name of the Vulnerable Software and Affected Versions Adcon Telemetry A840 Telemetry Gateway Base Station affected versions not specified Description The issue allows remote attackers to discover log-file pathnames. Recommendations At the moment, there is no information about a newer version that...

CVE-2015-6306: Undefined Security Weakness

Cisco AnyConnect Secure Mobility Client 4.18 on OS X and Linux does not verify pathnames before installation actions, which allows local users to obtain root privileges via a crafted installation file, aka Bug ID CSCuv11947...

CVE-2015-3760: Improper Input Validation

dyld in Apple OS X before 10.10.5 does not properly validate pathnames in the environment, which allows local users to gain privileges via unspecified vectors...

Apache Subversion Pathname Sensitive Information Disclosure Vulnerability

Apache Subversion is a free/open source version control system. Apache Subversion svnrepostracenodelocations has a security vulnerability that allows remote authenticated users to view pathnames hidden by authz...

Microsoft Internet Explorer Information Disclosure Vulnerability (CNVD-2015-04585)

Microsoft Internet Explorer IE is a Web browser developed by the American company Microsoft and is the default browser that comes with the Windows operating system. A security vulnerability exists in Microsoft IE versions 10 through 11. The vulnerability can be exploited by remote attackers to re...

Cisco AnyConnect Secure Mobility Client Privilege Setting Vulnerability

The Cisco AnyConnect Secure Mobility Client is a suite of devices that enable remote users to securely connect to the Cisco ASA 5500 appliance via SSL VPN. A security vulnerability in the handling of pathnames in the Cisco AnyConnect Secure Mobility Client for Windows-based platforms allows a loc...

PHP 5.5.x < 5.5.25 Multiple Vulnerabilities

According to its banner, the version of PHP 5.5.x running on the remote web server is prior to 5.5.25. It is, therefore, affected by multiple vulnerabilities : - A flaw in the pharparsetarfile function in ext/phar/tar.c could allow a denial of service via a crafted entry in a tar archive...

PHP 5.6.x < 5.6.9 Multiple Vulnerabilities

According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.9. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified flaws in pcrelib. CVE-2015-2325, CVE-2015-2326 - A flaw in the pharparsetarfile function in ext/phar/tar.c could...