PT-2012-6216

Name of the Vulnerable Software and Affected Versions VMware View versions 4.x through 4.6.1 VMware View versions 5.x through 5.1.1 Description The issue allows remote attackers to read arbitrary files due to multiple directory traversal vulnerabilities in the View Connection Server and View...

PT-2012-5346

Name of the Vulnerable Software and Affected Versions Symantec Messaging Gateway versions 9.5.x Description The issue concerns directory traversal vulnerabilities in the management console. These vulnerabilities allow remote authenticated users to read arbitrary files. This can be achieved by...

puppet: authenticated clients allowed to read arbitrary files from the puppet master

Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request...

PT-2012-5601

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 7.0.0.1 through 7.0.0.2 before CF19 IBM WebSphere Portal version 8.0 before CF03 Description A directory traversal issue exists in the theme component's LayerLoader.jsp, allowing remote attackers to read arbitrary...

CVE-2011-5245

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding JAXB input, aka an XML external entity XXE injection attack, a similar vulnerability to...

Mozilla: evalInSanbox location context incorrectly applied (MFSA 2012-93)

The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which...

PT-2012-5691

Name of the Vulnerable Software and Affected Versions Novell File Reporter version 1.0.2 Description The issue allows remote attackers to read arbitrary files via a "/FSF/CMD" request with a .. dot dot in a FILE element of an FSFUI record. This is a directory traversal vulnerability in...

PT-2012-5690

Name of the Vulnerable Software and Affected Versions Novell File Reporter version 1.0.2 Description The issue allows remote attackers to read arbitrary files due to an absolute path traversal vulnerability in NFRAgent.exe. This can be exploited via a /FSF/CMD request with a full pathname in a PA...

CVE-2012-4940: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a .. dot dot in 1 the fileName parameter in a download action to source/loggin/pagelogdwnfile.hsp, or the fileName parameter in 2 an...

PT-2012-2194

Name of the Vulnerable Software and Affected Versions Hitachi JP1/ServerConductor/DeploymentManager versions prior to 08-55 Japanese Hitachi JP1/ServerConductor/DeploymentManager versions prior to 08-51 English Description A directory traversal issue exists in the PXE Mtftp service, allowing remo...

PT-2012-1215

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 11.1.1.4 through 11.1.2.0 Description The issue is related to insufficient access control in the Oracle Reports Developer component of Oracle Fusion Middleware. It may allow a remote attacker to impact the...

PT-2012-1276 · Html2Ps · Html2Ps

Name of the Vulnerable Software and Affected Versions: html2ps versions prior to 1.0b6 Description: The issue allows remote attackers to read arbitrary files via a .. dot dot in the include file SSI directive. This might be a problem in limited scenarios, such as if html2ps is invoked by a web...

PT-2012-2185

Name of the Vulnerable Software and Affected Versions BackWPup plugin versions prior to 1.4.1 Description The issue allows remote attackers to read arbitrary files due to multiple directory traversal vulnerabilities in the BackWPup plugin. This is achieved by including a .. dot dot in the wpabs...

PT-2012-1488

Name of the Vulnerable Software and Affected Versions MODx Revolution versions 2.0.2-pl and earlier Description A directory traversal issue exists when magic quotes gpc is disabled, allowing remote attackers to read arbitrary files via a .. dot dot in the class key parameter. Recommendations For...

CVE-2012-0956: Undefined Security Weakness

ubiquity-slideshow-ubuntu before 58.2, during installation, allows remote man-in-the-middle attackers to execute arbitrary web script or HTML and read arbitrary files via a crafted attribute in the tag of a Twitter feed...

PT-2012-2972

Name of the Vulnerable Software and Affected Versions ubiquity-slideshow-ubuntu versions before 58.2 Description The issue allows remote man-in-the-middle attackers to execute arbitrary web script or HTML and read arbitrary files via a crafted attribute in the tag of a Twitter feed during...

CVE-2012-1617

Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. dot dot in the type parameter. NOTE: this vulnerability can be leveraged to upload arbitrary files...

CVE-2012-1103

emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message...

PT-2012-4435

Name of the Vulnerable Software and Affected Versions Fultek WinTr Scada versions 4.0.5 and earlier Description A directory traversal issue in the web server of Fultek WinTr Scada allows remote attackers to read arbitrary files by sending a crafted request. Recommendations For versions 4.0.5 and...

PT-2012-3083

Name of the Vulnerable Software and Affected Versions Notmuch versions prior to 0.11.1 Description The issue allows user-assisted remote attackers to read arbitrary files via crafted MML tags. When using the Emacs interface, these tags are not properly quoted in an email reply, which can cause th...