CVE-2012-1103: Improper Input Validation

emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message...

PT-2012-5619

Name of the Vulnerable Software and Affected Versions vtiger CRM version 5.1.0 Description A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by using a .. dot dot in the module name parameter. Recommendations For vtiger CRM version 5.1.0,...

PT-2012-5630

Name of the Vulnerable Software and Affected Versions FlatnuX CMS version 2011 08.09.2 Description The issue allows remote administrators to read arbitrary files via a full pathname in the dir parameter in a "contents/Files" action. This is due to an absolute path traversal vulnerability in the...

CVE-2012-4878: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 allows remote administrators to read arbitrary files via a full pathname in the dir parameter in a contents/Files action...

CVE-2012-3380

Directory traversal vulnerability in naxsi-ui/nxextract.py in the Naxsi module before 0.46-1 for Nginx allows local users to read arbitrary files via unspecified vectors...

CVE-2012-3380: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in naxsi-ui/nxextract.py in the Naxsi module before 0.46-1 for Nginx allows local users to read arbitrary files via unspecified vectors...

PT-2012-2785

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 6.0 Description The issue allows remote attackers to read arbitrary files via a feed:// URL. Recommendations For versions prior to 6.0, update to version 6.0 or later to resolve the issue...

CVE-2012-0679: Undefined Security Weakness

Apple Safari before 6.0 allows remote attackers to read arbitrary files via a feed:// URL...

CVE-2012-3697: Undefined Security Weakness

WebKit in Apple Safari before 6.0 does not properly handle file: URLs, which allows remote attackers to bypass intended sandbox restrictions and read arbitrary files by leveraging a WebProcess compromise...

DEBIAN-CVE-2012-2737

The userchangeiconfileauthorizedcb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition...

PT-2012-4225

Name of the Vulnerable Software and Affected Versions AccountsService versions prior to 0.6.22 Description The issue is related to the user change icon file authorized cb function in /usr/libexec/accounts-daemon, which does not properly check the UID when copying an icon file to the system cache...

CVE-2012-2737: Concurrent Execution using Shared Resource with Improper Synchronization

The userchangeiconfileauthorizedcb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition...

DEBIAN-CVE-2012-2139

Directory traversal vulnerability in lib/mail/network/deliverymethods/filedelivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. dot dot in the to parameter...

CVE-2012-2139

Directory traversal vulnerability in lib/mail/network/deliverymethods/filedelivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. dot dot in the to parameter...

PT-2012-5156

Name of the Vulnerable Software and Affected Versions Wangkongbao CNS-1000 and 1100 Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to read arbitrary files. The attack can be performed by including a .. dot dot in the lang ...

PT-2012-3831

Name of the Vulnerable Software and Affected Versions Mail gem versions prior to 2.4.4 Description The issue allows remote attackers to read arbitrary files via a .. dot dot in the to parameter. This is due to a directory traversal vulnerability in the lib/mail/network/delivery methods/file...

PT-2012-4831

Name of the Vulnerable Software and Affected Versions Plugin Newsletter plugin version 1.5 for WordPress Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the preview.php file. This is achieved by using a .. dot dot in the data...

PT-2012-4374

Name of the Vulnerable Software and Affected Versions Atlassian JIRA Gliffy plugin versions prior to 3.7.1 Atlassian Confluence Gliffy plugin versions prior to 4.2 Description The issue allows remote attackers to read arbitrary files or cause a denial of service due to improper restriction of...

PT-2012-2474

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions 5.0.x through 5.0.2 Description The issue concerns the file-management scripts in the management GUI, allowing remote attackers to read or delete arbitrary files. Recommendations For Symantec Web Gateway versions...

PT-2012-1344

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.2.x through 4.2.15 TYPO3 versions 4.3.x through 4.3.8 TYPO3 versions 4.4.x through 4.4.4 Description A directory traversal issue exists in the TypoScript setup, allowing remote authenticated administrators to read arbitrary...