662 matches found
CVE-2006-5858
CVE-2006-5858 affects Adobe ColdFusion MX 7–7.0.2 and JRun 4 when run on Microsoft IIS. The vulnerability allows remote attackers to read arbitrary files, list directories, or read source code by sending a double URL-encoded NULL byte in a ColdFusion filename (e.g., a .cfm file). This is a server...
PT-2006-5772 · Cakephp · Cakephp
Name of the Vulnerable Software and Affected Versions: CakePHP versions prior to 1.1.8.3544 Description: The issue allows remote attackers to read arbitrary files via a .. dot dot in the file parameter, followed by a filename ending with %00 and a .js filename. This is a directory traversal...
CVE-2006-4684
CVE-2006-4684 details (Zope/Zope2, docutils integration): Affects Zope 2.7.0–2.7.9 and 2.8.0–2.8.8. The vulnerability stems from improper handling of reStructuredText (reST) in web pages, allowing a remote attacker to read arbitrary files via a csv_table directive. CVSSv2 base metrics reported: A...
security flaw
Firefox 1.5.0.2 does not fix all test cases associated with CVE-2006-1729, which allows remote attackers to read arbitrary files by inserting the target filename into a text box, then turning that box into a file upload control...
security flaw
Firefox 1.5.0.2 does not fix all test cases associated with CVE-2006-1729, which allows remote attackers to read arbitrary files by inserting the target filename into a text box, then turning that box into a file upload control...
CVE-2006-3392
CVE-2006-3392 affects Webmin (pre-1.290) and Usermin (pre-1.220). The issue arises when the server’s miniserv.pl sanitization path uses the simplify_path function before HTML decoding, allowing a remote attacker to read arbitrary files via specially crafted URLs (eg, using ..%01 sequences that b...
CVE-2006-2317
Unspecified vulnerability in Ideal Science Ideal BB 1.5.4a and earlier allows remote attackers to read arbitrary files under the web root via unspecified attack vectors related to the OpenTextFile method in Scripting.FileSystemObject...
DEBIAN-CVE-2006-2082
Directory traversal vulnerability in Quake 3 engine, as used in products including Quake3 Arena, Return to Castle Wolfenstein, Wolfenstein: Enemy Territory, and Star Trek Voyager: Elite Force, when the svallowdownload cvar is enabled, allows remote attackers to read arbitrary files from the serve...
CVE-2006-1729
Mozilla Firefox 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to read arbitrary files by 1 inserting the target filename into a text box, then turning that box into a file upload control, or 2 changing the type of the...
CVE-2006-0484
Directory traversal vulnerability in Vis.pl, as part of the FACE CONTROL product, allows remote attackers to read arbitrary files via a .. dot dot in any parameter that opens a file, such as 1 s or 2 p...
CVE-2006-0434
Directory traversal vulnerability in action.php in phpXplorer allows remote attackers to read arbitrary files via ".." dot dot sequences and null bytes in the sAction parameter, a different vulnerability than CVE-2006-0244. NOTE: if the functionality of phpXplorer supports the upload of PHP files...
Directory traversal
Directory traversal vulnerability in action.php in phpXplorer allows remote attackers to read arbitrary files via ".." dot dot sequences and null bytes in the sAction parameter, a different vulnerability than CVE-2006-0244. NOTE: if the functionality of phpXplorer supports the upload of PHP files...
CVE-2005-3947
CVE-2005-3947 affects PHP Upload Center. A vulnerability in index.php allows directory traversal through the filename parameter (using ../), enabling an attacker to read arbitrary files on the server with the web server’s privileges. Technical details across sources confirm the vulnerable compone...
PT-2005-4687 · Php · Php Upload Center
Name of the Vulnerable Software and Affected Versions: PHP Upload Center affected versions not specified Description: A directory traversal issue exists in index.php, allowing remote attackers to read arbitrary files by including "../" sequences in the filename parameter of the vulnerable API...
CVE-2004-2594
CVE-2004-2594 affects the Quake II server on Windows prior to R1Q2. The vulnerability is an absolute path traversal in the server’s file access, allowing a remote attacker to read arbitrary files by including a "/" sequence in a pathname (example: download /server.cfg). The CVSS data indicates ne...
CVE-2004-2478
The CVE-2004-2478 entry concerns Jetty HTTP Server in affected products (IBM Trading Partner Interchange < 4.2.4; CA Unicenter Web Services Distributed Management
CVE-2000-1231
code.php3 in Phorum 3.0.7 allows remote attackers to read arbitrary files in the phorum directory via the query string...
CVE-2002-2033
FAQManager’s FAQManager CGI (faqmanager.cgi) is affected by CVE-2002-2033. The vulnerability occurs in version 2.2.5 and earlier, where an attacker can read arbitrary files on the web server by supplying a filename in the toc parameter with a trailing null character (%00). This is a web-applicati...
CVE-2002-1684
Directory traversal vulnerability in 1 Deerfield D2Gfx 1.0.2 or 2 BadBlue Enterprise Edition 1.5.x and BadBlue Personal Edition 1.5.6 allows remote attackers to read arbitrary files via a ../ dot dot slash in the script used to read Microsoft Office documents...