CVE-2013-6177: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allows remote authenticated users to read arbitrary...

PT-2013-6131

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description A directory traversal issue exists in the Exportability Check Service of SAP NetWeaver, allowing remote attackers to read arbitrary files. The exact vectors used for exploitation are no...

CVE-2013-6226: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in plugins/editor.zoho/agent/savezoho.php in the Zoho plugin in Pydio formerly AjaXplorer before 5.0.4 allows remote attackers to read or delete arbitrary files via unspecified vectors...

DEBIAN-CVE-2013-6172

steps/utils/savepref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code...

UBUNTU-CVE-2013-6172

steps/utils/savepref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code...

CVE-2013-6172

steps/utils/savepref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code...

PT-2013-5979

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions 7.31 and earlier Description The issue allows remote attackers to read arbitrary files and directories via an XML document containing an external entity declaration in conjunction with an entity reference, related to an...

PT-2013-1708

Name of the Vulnerable Software and Affected Versions Invensys Wonderware InTouch HMI versions 2012 R2 and earlier Description The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service through CPU and memory consumption. This i...

CVE-2013-5528: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815...

PT-2013-5609

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager affected versions not specified Description A directory traversal issue exists in the Tomcat administrative web interface, allowing remote authenticated users to read arbitrary files by using directory...

CVE-2013-1881

GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

PT-2013-4471

Name of the Vulnerable Software and Affected Versions AirLive WL2600CAM affected versions not specified Description A directory traversal issue exists in the cgi-bin/admin/fileread endpoint, allowing remote attackers to read arbitrary files by including a .. dot dot in the READ.filePath parameter...

CVE-2013-3541: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in cgi-bin/admin/fileread in AirLive WL2600CAM and possibly other camera models allows remote attackers to read arbitrary files via a .. dot dot in the READ.filePath parameter...

PT-2013-4954

Name of the Vulnerable Software and Affected Versions Django versions 1.4.x through 1.4.6 Django versions 1.5.x through 1.5.2 Django versions 1.6.x through 1.6 beta 2 Description The issue allows remote attackers to read arbitrary files via a file path in the ALLOWED INCLUDE ROOTS setting followe...

CVE-2013-3160: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft Office 2003 SP3 and 2007 SP3, Word 2003 SP3 and 2007 SP3, and Word Viewer allow remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka "XML External...

PT-2013-5265

Name of the Vulnerable Software and Affected Versions DeWeS web server version 0.4.2 and earlier Description The issue allows remote attackers to read arbitrary files via a ..%5c dot dot encoded backslash in a GET request. This is a directory traversal vulnerability. Recommendations For DeWeS web...

PT-2013-3292

Name of the Vulnerable Software and Affected Versions Open-Xchange Server versions prior to 6.20.7 rev14 Open-Xchange Server versions 6.22.0 prior to rev13 Open-Xchange Server versions 6.22.1 prior to rev14 Description The issue allows remote authenticated users to read arbitrary files via a .. d...

PT-2013-5145

Name of the Vulnerable Software and Affected Versions PHP OpenID Library version 2.2.2 and earlier Description The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via XRDS data containing an...

PT-2013-5461

Name of the Vulnerable Software and Affected Versions Trustport Webfilter version 5.5.0.2232 Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the help.php file. This is achieved by using a .. dot dot in the hf parameter...

Mozilla: Local Java applets may read contents of local file system (MFSA 2013-75)

Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly restrict local-filesystem access by Java applets, which allows user-assisted remote attackers to read arbitrary files by leveraging...