tomcat RequestDispatcher information disclosure vulnerability

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. d...

Absolute path traversal Apache Tomcat WEBDAV

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag...

CVE-2008-2370

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. d...

Cybozu products vulnerable to directory traversal

Overview Multiple Cybozu products contain a directory traversal vulnerability. Impact A remote authenticated attacker could read an arbitrary file on the server. The files that can be viewed by an attacker depend on the environment where the Cybozu products are installed. Solution None...

Absolute path traversal Apache Tomcat WEBDAV

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag...

Absolute path traversal Apache Tomcat WEBDAV

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag...

CVE-2008-1281

The CVE-2008-1281 issue affects TFTPsrvs.exe 2.5.3.1 and earlier, as used in Argon Technology Client Management Services (CMS) 1.31 and earlier. The underlying vulnerability is a directory traversal via .. in the filename parameter, enabling remote attackers to read arbitrary files. Connected sou...

CVE-2007-6508

Directory traversal vulnerability in view.php in xeCMS 1.0 allows remote attackers to read arbitrary files via a ..%2F dot dot slash in the list parameter...

CVE-2007-6404

Directory traversal vulnerability in Sergey Lyubka Simple HTTPD shttpd 1.38 and earlier on Windows allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the URI...

Design/Logic Flaw

The fopen function in PHP 5.2.0 does not properly handle invalid URI handlers, which allows context-dependent attackers to bypass safemode restrictions and read arbitrary files via a file path specified with an invalid URI, as demonstrated via the srpath URI...

Directory traversal

Directory traversal vulnerability in rdwhelpers.py in rdiffWeb before 0.3.5.1 allows remote attackers to read arbitrary files via a .. dot dot in the path parameter to the /browse URI...

CVE-2006-7117

Multiple directory traversal vulnerabilities in Kubix 0.7 and earlier allow remote attackers to 1 include and execute arbitrary local files via ".." sequences in the theme cookie to index.php, which is not properly handled by includes/head.php; and 2 read arbitrary files via ".." sequences in the...

CVE-2006-6381

Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2006-6259

Multiple directory traversal vulnerabilities in a class/functions.php and b class/mbro.php in AlternC 0.9.5 and earlier allow remote attackers to 1 create arbitrary files and directories via a .. dot dot in the "create name" field and 2 read arbitrary files via a .. dot dot in the "web root" fiel...

CVE-2006-6259

Multiple directory traversal vulnerabilities in a class/functions.php and b class/mbro.php in AlternC 0.9.5 and earlier allow remote attackers to 1 create arbitrary files and directories via a .. dot dot in the "create name" field and 2 read arbitrary files via a .. dot dot in the "web root" fiel...

DEBIAN-CVE-2006-2658

Directory traversal vulnerability in the xsp component in modmono in Mono/C web server, as used in SUSE Open-Enterprise-Server 1 and SUSE Linux 9.2 through 10.0, allows remote attackers to read arbitrary files via a .. dot dot sequence in an HTTP request...

Directory traversal

Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and earlier allow remote attackers to use ".." dot dot sequences to 1 read arbitrary files via the file parameter in a rqEditHtml command to document/rqmkhtml.php or 2 execute arbitrary code via the includePa...

CVE-2006-1062

Unspecified vulnerability in lurker.cgi for Lurker 2.0 and earlier allows attackers to read arbitrary files via unknown vectors...

PYSEC-2006-1

Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors...

CVE-2005-1445

Multiple directory traversal vulnerabilities in SitePanel 2.6.1 and earlier SitePanel2 allows remote attackers to 1 delete arbitrary files via the id parameter in a rmattach action to 5.php, or 2 read arbitrary files via the lang parameter to index.php...