CVE-2013-0182

The Payment module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to payments, which allows remote attackers to read arbitrary payments...

qt: QSharedMemory class created shared memory segments with insecure permissions

The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions world-readable and world-writable for shared memory segments, which allows local users to read sensitive information or modify critical program data, as demonstrat...

FreeBSD : php5 -- Multiple vulnerabilities (1d23109a-9005-11e2-9602-d43d7e0c7c02)

The PHP development team reports : PHP does not validate the relationship between the soap.wsdlcachedir directive and the openbasedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory. The...

KLA10220 OSI vulnerability in Inkscape

A wrong directory reading was found in Inkscape. By exploiting this vulnerability malicious users can obtain sensitive information or possibly conduct other attacks. This vulnerability can be exploited locally via file operations. Original advisories - Related products Inkscape CVE list...

[PT-2013-17] Arbitrary Files Reading in mnoGoSearch

----------------------------------------------------------- PT-2013-17 Positive Technologies Security Advisory Arbitrary Files Reading in mnoGoSearch ----------------------------------------------------------- --- Vulnerable software mnoGoSearch Version: 3.3.12 and earlier Application link:...

[JSQL v0.3] Java Tool for Automatic Database Injection

jSQL Injection is a lightweight application used to find database information from a distant server. jSQL is free, open source and cross-platform Windows, Linux, Mac OS X, Solaris. Version 0.2 features: GET, POST, header, cookie methods normal, error based, blind, time based algorithms automatic...

CVE-2011-3201

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email...

CVE-2011-3201

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email...

CVE-2011-3201

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email...

mnoGoSearch 3.3.12 (search.cgi) - Arbitrary File Read

mnoGoSearch 3.3.12 search.cgi - Arbitrary File Read ----------------------------------------------------------- PT-2013-17 Positive Technologies Security Advisory Arbitrary Files Reading in mnoGoSearch ----------------------------------------------------------- --- Vulnerable software mnoGoSearch...

mnoGoSearch 3.3.12 (search.cgi) - Arbitrary File Read Vulnerability

Exploit for cgi platform in category web applications --- Vulnerable software mnoGoSearch Version: 3.3.12 and earlier Application link: http://www.mnogosearch.org/ --- Severity level Severity level: High Impact: Arbitrary Files Reading Access Vector: Remote CVSS v2: Base Score: 7.8 Vector:...

mnoGoSearch 3.3.12 (search.cgi) - Arbitrary File Read

----------------------------------------------------------- PT-2013-17 Positive Technologies Security Advisory Arbitrary Files Reading in mnoGoSearch ----------------------------------------------------------- --- Vulnerable software mnoGoSearch Version: 3.3.12 and earlier Application link:...

Debian: Security Advisory (DSA-2639-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-6093

Removed by vendor...

PT-2013-17: Arbitrary Files Reading in mnoGoSearch

Positive Technologies experts have detected an Arbitrary Files Reading vulnerability in mnoGoSearch. Passing startup parameters via QUERYSTRING http://tools.ietf.org/html/draft-robinson-www-interface-00section-7 for an application running in CGI mode can be used to set page template path variable...

CVE-2012-6531

1 ZendDom, 2 ZendFeed, and 3 ZendSoap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC...

PT-2013-14: XML External Entities Injection in PHP

The specialists of Positive Technologies have detected an "XXE" vulnerability in PHP. The vulnerability was detected in the PHP's built-in SoapClient and SoapServer classes. PHP allows the use of external entities while parsing SOAP wsdl files which allows an attacker to read arbitrary files. If ...

CVE-2013-1107

The search function in Cisco Webex Social formerly Cisco Quad allows remote authenticated users to read files via unspecified parameters, aka Bug ID CSCud40235...

CVE-2013-1107

The CVE-2013-1107 case concerns Cisco Webex Social (formerly Cisco Quad). The vulnerability is in the product’s search function, where remote authenticated users could read files via unspecified parameters (Bug ID CSCud40235). The entry has a CVSSv2 base score of 4.0 (Medium) with network attack ...

Design/Logic Flaw

The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration...