Path traversal

Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the...

CVE-2014-3697

Absolute path traversal vulnerability in the untarblock function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a drive name in a tar archive of a smiley theme...

CVE-2014-3697

The CVE-2014-3697 issue affects Pidgin for Windows, where the untar_block function in win32/untar.c allows absolute path traversal via a tar archive’s drive name in a smiley theme. This enables remote attackers to write files to arbitrary locations on the victim system. Public references indicate...

CVE-2014-4877

Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the...

UBUNTU-CVE-2014-4877

Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the...

Path traversal

Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary files via a full pathname in the url parameter...

CVE-2014-4577

The CVE-2014-4577 entry concerns the WordPress plugin WP AmASIN – The Amazon Affiliate Shop (versions 0.9.6 and earlier). The vulnerability is a Local File Inclusion in reviews.php that allows remote attackers to read arbitrary files by supplying a full pathname in the url parameter. Impact inclu...

Open-Xchange Security Advisory 2014-09-15

Product: OX App Suite Vendor: Open-Xchange GmbH Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.6.0 and earlier Vulnerable component: frontend Fixed version: 7.4.2-rev33, 7.6.0-rev16 Report confidence: Confirmed Solution status: Fixed by Vendor Vendor notification: 2014-07-1...

CVE-2013-5757

Yealink VoIP Phone SIP-T38G is affected by CVE-2013-5757 (absolute path traversal) via the cgiServer.exx command parameter (dumpConfigFile). The vulnerability allows remote authenticated users to read arbitrary files by supplying a full pathname, with corroborating references describing /etc/pass...

Method 2.1 - dl-skin.php _mysite_download_skin Parameter Absolute Path Traversal Remote File Download

The method WordPress theme was affected by a dl-skin.php mysitedownloadskin Parameter Absolute Path Traversal Remote File Download security vulnerability...

DejaVu 2.4 - dl-skin.php _mysite_delete_skin_zip Parameter Absolute Path Traversal Remote Directory Deletion

The dejavu WordPress theme was affected by a dl-skin.php mysitedeleteskinzip Parameter Absolute Path Traversal Remote Directory Deletion security vulnerability...

Construct 1.4 - dl-skin.php _mysite_delete_skin_zip Parameter Absolute Path Traversal Remote Directory Deletion

The construct WordPress theme was affected by a dl-skin.php mysitedeleteskinzip Parameter Absolute Path Traversal Remote Directory Deletion security vulnerability...

Persuasion <= 2.4 - dl-skin.php _mysite_download_skin Parameter Absolute Path Traversal Remote File Download

The persuasion WordPress theme was affected by a dl-skin.php mysitedownloadskin Parameter Absolute Path Traversal Remote File Download security vulnerability...

CVE-2014-5115

DirPHP 1.0 is affected by an Absolute Path Traversal (Local File Inclusion) via the phpfile parameter to index.php, enabling read access to arbitrary files. Public references (e.g., Exploit-DB, Packet Storm) and OpenVAS describe the issue as a DirPHP LFI vulnerability. The available documents do ...

WEBInsta MM <= 1.3e (absolute_path) Remote File Include Exploit

No description provided by source. !-- vulnerable code: /maillist/inc/initdb.php ----------------------------------------------------------------------- ifisset$GET'absolutepath' echo no access from here !!; exit; include$absolutepath.'inc/adodbt/db.inc';...

Mozilla Bonsai 1.3 Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5517/info A path disclosure vulnerability has been reported in Mozilla Bonsai. An attacker can exploit this vulnerability by making a malformed request to Bonsai. This causes Bonsai to return an error page to the requesti...

mambo com_babackup Component <= 1.1 File Include Vulnerability

No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register class TestPOCPOCBase: vulID = '63864' ssvid version = '1.0' author = '皮皮' vulDate = '2006-08-22' createDate = '2015-12-24...

joomla component mosmedialite451 - Remote File Inclusion Vulnerability

No description provided by source. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Scripts : MOSMediaLite451 Discovered By : k1n9k0ng Scripts site : http://www.djoomla.com/component/option,comremository/Itemid,2/func,fileinfo/id,104/ Thanks To :...

TCLhttpd 3.4.2 Directory Listing Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8687/info It has been reported that a vulnerability present in TCLHttpd allows for attackers to view the contents of arbitrary directories on affected web servers. According to the report, the input validation implemented...

Oracle Application Server 9i Webcache Arbitrary File Corruption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13420/info Oracle Application Server 9i Webcache is prone to an arbitrary file corruption vulnerability. The issue exists becaue dangerous characters are not removed from a certain parameter value, allowing an attacker to...