Integrigy Security Advisory - Oracle Applications FNDFS Vulnerability

Integrigy Security Advisory Oracle E-Business Suite FNDFS Vulnerability April 10, 2003 Summary: The Oracle Applications FNDFS program, used to retrieve report output from the Concurrent Manager server, can be used to remotely retrieve any file from the server without operating system or applicati...

CVE-2002-1437

Directory traversal vulnerability in the web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to read arbitrary files via an HTTP request containing "..%5c" URL-encoded dot-dot backslash sequences...

CVE-2002-1430

Unknown vulnerability in Sympoll 1.2 allows remote attackers to read arbitrary files when registerglobals is enabled, possibly by modifying certain PHP variables through URL parameters...

CVE-2002-0860

The LoadText method in the spreadsheet component in Microsoft Office Web Components OWC 2000 and 2002 allows remote attackers to read arbitrary files through Internet Explorer via a URL that redirects to the target file...

CVE-2002-1039

The vulnerability CVE-2002-1039 affects Double Choco Latte (DCL) prior to 20020706. A directory traversal in the Projects: Attachments feature lets remote attackers read arbitrary files by manipulating .. sequences during file download. The impact is described as partial confidentiality loss. No ...

CVE-2002-1504

Directory traversal vulnerability in WebServer 4 Everyone 1.22 allows remote attackers to read arbitrary files via ".." dot-dot backslash sequences in a URL...

CVE-2002-1515

Directory traversal vulnerability in avatar.php in CoolForum 0.5 beta allows remote attackers to read arbitrary files via .. dot dot sequences in the img parameter...

CVE-2002-0946

CVE-2002-0946 affects SeaNox Devwex prior to 1.2002.0601 and is a directory traversal vulnerability that allows remote attackers to read arbitrary files via ..\ (dot dot) sequences in an HTTP request. The issue targets the path handling in the HTTP interface and results in partial confidentiality...

CVE-2002-1004

Directory traversal vulnerability in webmail feature of ArGoSoft Mail Server Plus or Pro 1.8.1.5 and earlier allows remote attackers to read arbitrary files via .. dot dot sequences in a URL...

CVE-2002-0543

Directory traversal vulnerability in Aprelium Abyss Web Server abyssws before 1.0.0.2 allows remote attackers to read files outside the web root, including the abyss.conf file, via URL-encoded .. dot dot sequences in the HTTP request...

CVE-2002-0531

Directory traversal vulnerability in emumail.cgi in EMU Webmail 4.5.x and 5.1.0 allows remote attackers to read arbitrary files or list arbitrary directories via a .. dot dot in the type parameter...

CVE-2002-1525

Directory traversal vulnerability in ASTAware SearchDisk engine for Sun ONE Starter Kit 2.0 allows remote attackers to read arbitrary files via a .. dot dot attack on port 1 6015 or 2 6016, or 3 an absolute pathname to port 6017...

CVE-2002-1504

Directory traversal vulnerability in WebServer 4 Everyone 1.22 allows remote attackers to read arbitrary files via ".." dot-dot backslash sequences in a URL...

CVE-2002-1423

tmpview.php in FUDforum before 2.2.0 allows remote attackers to read arbitrary files via an absolute pathname in the file parameter...

CVE-2002-1460

L-Forum 2.40 and earlier does not properly verify whether a file was uploaded or if the associated variables were set by POST attachment, attachmentname, attachmentsize and attachmenttype, which allows remote attackers to read arbitrary files...

CVE-2002-1498

Directory traversal vulnerability in SWServer 2.2 and earlier allows remote attackers to read arbitrary files via a URL containing .. sequences with "/" or "" characters...

CVE-2002-1483

db4webc and db4webc.exe programs in DB4Web 3.4 and 3.6 allow remote attackers to read arbitrary files via an HTTP request whose argument is a filename of the form 1 C: drive letter, 2 //absolute/path double-slash, or 3 .. dot-dot...

DEBIAN-CVE-2002-1348

w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attackers to access files or cookies...

PHP CGI unauthorized access

--enable-force-cgi-redirect option doesn't work. It allows remote file access and custom PHP code execution...

CVE-2003-0017

Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such as "", which causes a different filename to be processed and served...