Path traversal

Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary files via a full pathname in the url parameter...

CVE-2014-4577

The CVE-2014-4577 entry concerns the WordPress plugin WP AmASIN – The Amazon Affiliate Shop (versions 0.9.6 and earlier). The vulnerability is a Local File Inclusion in reviews.php that allows remote attackers to read arbitrary files by supplying a full pathname in the url parameter. Impact inclu...

Open-Xchange Security Advisory 2014-09-15

Product: OX App Suite Vendor: Open-Xchange GmbH Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.6.0 and earlier Vulnerable component: frontend Fixed version: 7.4.2-rev33, 7.6.0-rev16 Report confidence: Confirmed Solution status: Fixed by Vendor Vendor notification: 2014-07-1...

CVE-2013-5757

Yealink VoIP Phone SIP-T38G is affected by CVE-2013-5757 (absolute path traversal) via the cgiServer.exx command parameter (dumpConfigFile). The vulnerability allows remote authenticated users to read arbitrary files by supplying a full pathname, with corroborating references describing /etc/pass...

Method 2.1 - dl-skin.php _mysite_download_skin Parameter Absolute Path Traversal Remote File Download

The method WordPress theme was affected by a dl-skin.php mysitedownloadskin Parameter Absolute Path Traversal Remote File Download security vulnerability...

DejaVu 2.4 - dl-skin.php _mysite_delete_skin_zip Parameter Absolute Path Traversal Remote Directory Deletion

The dejavu WordPress theme was affected by a dl-skin.php mysitedeleteskinzip Parameter Absolute Path Traversal Remote Directory Deletion security vulnerability...

Construct 1.4 - dl-skin.php _mysite_delete_skin_zip Parameter Absolute Path Traversal Remote Directory Deletion

The construct WordPress theme was affected by a dl-skin.php mysitedeleteskinzip Parameter Absolute Path Traversal Remote Directory Deletion security vulnerability...

Persuasion <= 2.4 - dl-skin.php _mysite_download_skin Parameter Absolute Path Traversal Remote File Download

The persuasion WordPress theme was affected by a dl-skin.php mysitedownloadskin Parameter Absolute Path Traversal Remote File Download security vulnerability...

CVE-2014-5115

DirPHP 1.0 is affected by an Absolute Path Traversal (Local File Inclusion) via the phpfile parameter to index.php, enabling read access to arbitrary files. Public references (e.g., Exploit-DB, Packet Storm) and OpenVAS describe the issue as a DirPHP LFI vulnerability. The available documents do ...

WEBInsta MM <= 1.3e (absolute_path) Remote File Include Exploit

No description provided by source. !-- vulnerable code: /maillist/inc/initdb.php ----------------------------------------------------------------------- ifisset$GET'absolutepath' echo no access from here !!; exit; include$absolutepath.'inc/adodbt/db.inc';...

Jakarta Tomcat 3.x/4.0 Error Message Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3199/info When a malformed request is made for a Java Server Page the server displays an error page. The error page contains potentially sensitive information, along with the absolute path of the JSP file on the webserver...

Coppermine Photo Gallery <= 1.4.22 Remote Exploit

No description provided by source. !/usr/bin/perl Coppermine Photo Gallery = 1.4.22 Remote Exploit Need registerglobals = on and magicquotesgpc = off Based on vulnerabilities discussed at http://www.milw0rm.org/exploits/8713 Coded by girex use LWP::UserAgent; ifnot defined $ARGV0 banner; print -...

TCLhttpd 3.4.2 Directory Listing Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8687/info It has been reported that a vulnerability present in TCLHttpd allows for attackers to view the contents of arbitrary directories on affected web servers. According to the report, the input validation implemented...

pollxt Mambo Component <= 1.22.07 Remote Include Vulnerability

No description provided by source. Application : pollxt mambo Component URL : http://www.mamboxt.com Variable $mosConfigabsolutepath not sanitized: xpl works with registerglobals=on in components/compollxt/conf.pollxt.php on line 1-2...

Oracle Application Server 9i Webcache Arbitrary File Corruption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13420/info Oracle Application Server 9i Webcache is prone to an arbitrary file corruption vulnerability. The issue exists becaue dangerous characters are not removed from a certain parameter value, allowing an attacker to...

Agora.CGI 3/4 Debug Mode Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3976/info Agora.cgi is a freely available, open source shopping cart system. When debug mode is enabled, it is possible for a remote attacker to display the absolute path to the directory that the agora.cgi script is stor...

Joomla Visites 1.1 - Component mosConfig_absolute_path Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28942/info The Visites component for Joomla! is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to compromise the...

joomla component mosmedialite451 - Remote File Inclusion Vulnerability

No description provided by source. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Scripts : MOSMediaLite451 Discovered By : k1n9k0ng Scripts site : http://www.djoomla.com/component/option,comremository/Itemid,2/func,fileinfo/id,104/ Thanks To :...

NewAtlanta ServletExec/ISAPI 4.1 Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4793/info ServletExec/ISAPI is a plug-in Java Servlet/JSP engine for Microsoft IIS. It runs with IIS on Microsoft Windows NT/2000/XP systems. ServletExec/ISAPI discloses the absolute path to the webroot directory when sen...

Mozilla Bonsai 1.3 Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5517/info A path disclosure vulnerability has been reported in Mozilla Bonsai. An attacker can exploit this vulnerability by making a malformed request to Bonsai. This causes Bonsai to return an error page to the requesti...