288 matches found
Mozilla: Sandbox escape allowing file system read access through file picker (MFSA 2017-12)
A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird 52.1,...
CVE-2017-5454
A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird 52.1,...
UBUNTU-CVE-2017-5454
A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird 52.1,...
Directory Traversal
aiohttp is vulnerable to directory traversal attacks. This is because it does not sanitize relative paths correctly...
plone file system information disclosure vulnerability
Plone is a free, open source Content Management System CMS. An information disclosure vulnerability exists in the plone file system. An attacker could exploit this vulnerability to read data on a target machine running plone by using relative paths and guessing the location of the Plone server...
ha -- Directory traversals
Alexander Cherepanov reports: Version 0.999b and older of ha archiver is susceptible to directory traversal vulnerabilities via absolute and relative paths...
YaBB 9.1.2000 Arbitrary File Read Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1668/info YaBB.pl, a web-based bulletin board script, stores board postings in numbered text files. The numbered file name is specified in the call to YaBB.pl in the variable num=file. Before retrieving the file, YaBB wil...
Google Fixes 28 Security Flaws in Chrome 33
Google Chrome 33 is out, and the new version of the browser includes fixes for 28 security vulnerabilities, including a number of high-severity bugs. The company paid out more than $13,000 in rewards to researchers who reported vulnerabilities that were fixed in this release. One of the...
WowzaMediaServer StorageDir escape (regression)
Product: Wowza Media Server URL: http://www.wowza.com/ Description: WMS is a quite popular RTMP/HLS/HDS/RTSP streaming server Issue: In early 2009 I reported problem with processing of requests with relative paths. The issue surfaced again. In a nutshell, you can escape Applications StorageDir...
WowzaMediaServer StorageDir Constraint Bypass
Product: Wowza Media Server URL: http://www.wowza.com/ Description: WMS is a quite popular RTMP/HLS/HDS/RTSP streaming server Issue: In early 2009 I reported problem with processing of requests with relative paths. The issue surfaced again. In a nutshell, you can escape Applications StorageDir...
Scientific Linux Security Update : elinks on SL4.x, SL5.x i386/x86_64
CVE-2007-2027 elinks tries to load .po files from a non-absolute path CVE-2008-7224 elinks: entitycache static array buffer overflow off-by-one An off-by-one buffer overflow flaw was discovered in the way ELinks handled its internal cache of string representations for HTML special entities. A...
CentOS Update for elinks CESA-2009:1471 centos5 i386
Check for the Version of elinks OpenVAS Vulnerability Test CentOS Update for elinks CESA-2009:1471 centos5 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it und...
SuSE 10 Security Update : cvs (ZYPP Patch Number 7302)
cvs fails with 'invalid pathname' error when using relative paths. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid51638; scriptversion"1.7...
Mandriva Update for symlinks MDVA-2008:140 (symlinks)
Check for the Version of symlinks OpenVAS Vulnerability Test Mandriva Update for symlinks MDVA-2008:140 symlinks Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...
Mandriva Update for symlinks MDVA-2008:140 (symlinks)
Check for the Version of symlinks OpenVAS Vulnerability Test Mandriva Update for symlinks MDVA-2008:140 symlinks Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...
CVE-2009-1272
The phpzipmakerelativepath function in phpzip.c in PHP 5.2.x before 5.2.9 allows context-dependent attackers to cause a denial of service crash via a ZIP file that contains filenames with relative paths, which is not properly handled during extraction...
Input validation
The phpzipmakerelativepath function in phpzip.c in PHP 5.2.x before 5.2.9 allows context-dependent attackers to cause a denial of service crash via a ZIP file that contains filenames with relative paths, which is not properly handled during extraction...
-moz-binding property bypasses security checks on codebase principals — Mozilla
Security researcher Collin Jackson reported that the -moz-binding CSS property can be used to bypass security checks which validate codebase principals. Similar to the issue reported in MFSA 2008-23, Jackson demonstrated that an attacker can replace a stylesheet in a signed JAR which uses relativ...
Debian Security Advisory DSA 534-1 (mailreader)
The remote host is missing an update to mailreader announced via advisory DSA 534-1. OpenVAS Vulnerability Test $Id: deb5341.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 534-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...