perl-Archive-Tar directory traversal flaws

Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an absolute path or has ".." sequences...

File inputs can disclose the path to selected files – Opera Security Advisories

File inputs can disclose the path to selected files – Opera Security Advisories OPCOM Team | June 29, 2010 Severity Less severe Description When a file is selected in a file upload input, the path to that file is not exposed through the input’s value property. This is done to protect any sensitiv...

Ubuntu: Security Advisory (USN-953-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : fastjar vulnerability (USN-953-1)

Dan Rosenberg discovered that fastjar incorrectly handled file paths containing '..' when unpacking archives. If a user or an automated system were tricked into unpacking a specially crafted jar file, arbitrary files could be overwritten with user privileges. Note that Tenable Network Security ha...

USN-953-1: fastjar vulnerability

Dan Rosenberg discovered that fastjar incorrectly handled file paths containing ".." when unpacking archives. If a user or an automated system were tricked into unpacking a specially crafted jar file, arbitrary files could be overwritten with user privileges...

iClone - SQL Injection

iClone - SQL Injection 1 1 0 I'm Sid3^effects member from Inj3ct0r Team 1 1 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 Name : iClone SQLi Vulnerability Date : june, 9 2010 Vendor url :http://www.reallusion.com/iclone/ Platform: Windows Price:$199 Author :...

Phreebooks 2.0 - Local File Inclusion

Advisory Name: Local File Inclusion in Phreebooks v2.0 Internal Cybsec Advisory Id: Vulnerability Class: Local File Inclusion Release Date: 2010-05-26 Affected Applications: Phreebooks v2.0 Affected Platforms: Any running Phreebooks v2.0 Local / Remote: Remote Severity: Medium – CVSS: 5...

DEBIAN-CVE-2010-1646

The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable...

Oracle Java Web Start Launch Command-Line Injection (CVE-2010-0886; CVE-2010-0887; CVE-2010-1423)

The Oracle Java Web Start is a component of the Java 2 Runtime Environment JRE. It facilitates network deployment of applications developed with the Java programming language. This component enables stand-alone Java applications to be downloaded from a remote network location and run on a target...

The system paths are to be locked down to the JIRA Home directory

Currently JIRA allows you to change system file paths at runtime. While convenient, this allowed an attacker to elevate his/her stolen system admin access into a situation where he/her can execute arbitrary code. A decision has been made to remove the ability to set the paths at run time. For new...

The system paths are to be locked down to the JIRA Home directory

Currently JIRA allows you to change system file paths at runtime. While convenient, this allowed an attacker to elevate his/her stolen system admin access into a situation where he/her can execute arbitrary code. A decision has been made to remove the ability to set the paths at run time. For new...

Maxs Photo Album - Arbitrary File Upload

Maxs Photo Album - Arbitrary File Upload ======================================================================================== | Title : Max's Photo Album Shell Upload Vulnerability | Author : indoushka | email : [email protected] | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria...

Cisco Collaboration Server 5 Cross Site Scripting / Code Disclosure

Title: Cisco Collaboration Server 5 XSS, Source Code Disclosure Author: s4squatch Published: 2010-02-11 Cisco Collaboration Server 5 XSS, Source Code Disclosure Discovered by: s4squatch of SecureState R&D Team www.securestate.com Discovered: 08/26/2008 Note: End of Engineering --...

Cisco Collaboration Server 5 XSS, Source Code Disclosure

Exploit for unknown platform in category web applications ======================================================== Cisco Collaboration Server 5 XSS, Source Code Disclosure ======================================================== Cisco Collaboration Server 5 XSS, Source Code Disclosure Discovered...

SAP BusinessObjects 'HappyAxis2.jsp' Information Disclosure

The SAP BusinessObjects installation on the remote web server is leaking information via '/BusinessProcessBI/axis2-web/HappyAxis.jsp'. This page contains debugging information such as local file paths, operating system version, and Java version. A remote attacker could use this information to mou...

PT-2010-1838 · Transmission · Transmission

Name of the Vulnerable Software and Affected Versions: Transmission versions 1.22, 1.34, 1.75, and 1.76 Description: The issue allows remote attackers to overwrite arbitrary files via a .. dot dot in a pathname within a .torrent file. This is due to a directory traversal vulnerability in...

Traffic Exchange Script 1.1 Cross Site Scripting

/\ == \ /\ \ /\ \ \ \ XSS http://server/path/faq.php?rid="/XSS http://server/path/register.php?rid="/XSS ------------------------------------------------------------------------------------------ EOF...

Microsoft ASP.NET Resource Paths Canonicalization (MS05-004; CVE-2004-0847)

The .NET framework is a windows framework for building and running software. The framework supports a variety of programming languages. A component of this framework is ASP.NET which allows for the development of dynamic Web applications in different programming languages. A vulnerability exists ...

[20090722] - Core - Missing JEXEC Check

Some files were missing the check for JEXEC. These scripts will then expose internal path information of the host...

Ocean CMS 0.0.2 Remote File Inclusion Vulnerability

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + + + Ocean CMS 0.0.2 Remote File Inclusion Vulnerability + + + + Discovered by Cru3l.b0y + + + + WwW.DeltaHacking.Net + + + + + + + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ AUTHOR : Cru3l.b0y...