WordPress <= 2.3.3 'index.php' Arbitrary File Access

Binary data 4482.prm...

Code injection

tss 0.8.1 allows local users to read arbitrary files via the -a parameter, which is processed while tss is running with privileges...

HP OpenView Network Node Manager OpenView5.exe Action Parameter Traversal Arbitrary File Access

The version of HP OpenView Network Node Manager installed on the remote host fails to completely sanitize user input to the 'Action' parameter of the 'OpenView5.exe' CGI script. Using a value with directory traversal sequences containing slashes rather than backslashes, an unauthenticated, remote...

HP OpenView Network Node Manager (OV NNM) 7.x - 'OpenView5.exe?Action' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/28745/info HP OpenView Network Node Manager is prone to multiple vulnerabilities affecting the 'ovalarmsrv.exe' and 'ovtopmd.exe' processes. These issues include a directory-traversal issue and multiple denial-of-service issues. UPDATE April 14, 2008:...

Alkacon OpenCMS 7.0.3 - logfileViewSettings.jsp?filePath.0 Arbitrary File Access

Alkacon OpenCMS 7.0.3 - logfileViewSettings.jsp?filePath.0 Arbitrary File Access source: https://www.securityfocus.com/bid/28152/info Alkacon OpenCms is prone to multiple input-validation vulnerabilities, including one cross-site scripting issue and a file-disclosure issue, because the applicatio...

CVE-2008-0923

Directory traversal vulnerability in the Shared Folders feature for VMWare ACE 1.0.2 and 2.0.2, Player 1.0.4 and 2.0.2, and Workstation 5.5.4 and 6.0.2 allows guest OS users to read and write arbitrary files on the host OS via a multibyte string that produces a wide character string containing...

Directory traversal

Directory traversal vulnerability in SafeNet Sentinel Protection Server 7.4.1.0 and earlier, and Sentinel Keys Server 1.0.4.0 and earlier, allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the URI. NOTE: this issue reportedly exists because of an incomplete fix for...

BitDefender Update Server HTTP Request Traversal Arbitrary File Access

The version of BitDefender Update Server running on the remote host fails to sanitize request strings of directory traversal sequences, which allows an unauthenticated attacker to read files outside the web server's document directory. Note that the server runs with LocalSystem privileges by...

CuteNews < 1.4.6 search.php files_arch Array Arbitrary File Access

Binary data 4324.prm...

CuteNews search.php files_arch Array Arbitrary File Access

The version of CuteNews on the remote host fails to initialize the 'filesarch' array before populating it with a list of files to search in the 'search.php' script. Regardless of PHP's 'registerglobals' setting, an unauthenticated attacker can leverage this issue to determine the existence of...

Tikiwiki tiki-listmovies.php movie Parameter Traversal Arbitrary File Access

The remote host is running TikiWiki, an open source wiki application written in PHP. The version of TikiWiki installed on the remote host fails to sanitize input to the 'movie' parameter of the 'tiki-listmovies.php' script before using it to access files. An unauthenticated attacker may be able t...

CVE-2007-6506

The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlier, including 3.0.8.4, allows remote attackers to 1 overwrite and corrupt arbitrary files via arguments to the SaveToFile method, and possibly 2 access arbitrary files via the...

CVE-2007-6506

The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlier, including 3.0.8.4, allows remote attackers to 1 overwrite and corrupt arbitrary files via arguments to the SaveToFile method, and possibly 2 access arbitrary files via the...

CVE-2007-6212

CVE-2007-6212: Directory traversal in region.php of KML share 1.1 lets remote attackers read arbitrary server files by passing ".." in the layer parameter. Affected: KML share 1.1 (region.php). Root cause: improper validation leading to directory traversal. Impact: partial confidentiality breach ...

2007-06 Sentinel Protection Server Directory Traversal

Title ----- Sentinel Protection Server Directory Traversal Severity -------- High Date Discovered --------------- October 10th, 2007 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: Corey Lebleu Vulnerability Description ------------------------- A classic...

Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : firefox vulnerabilities (USN-535-1)

Various flaws were discovered in the layout and JavaScript engines. By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user's privileges. CVE-2007-5336, CVE-2007-5339, CVE-2007-5340 Michal Zalewski discovered that the onUnload event handlers we...

CVE-2004-2745

The CVE-2004-2745 entry describes a directory traversal vulnerability in Anteco Visual Technologies OwnServer 1.0 and earlier, allowing remote attackers to read arbitrary files via a .. sequence in a URL. Affected component: OwnServer (version 1.0 and earlier). Underlying cause and exact root cau...

Design/Logic Flaw

httpd.tkd in Radia Integration Server in Hewlett-Packard HP OpenView Configuration Management CM Infrastructure 4.0 through 4.2i and Client Configuration Manager CCM 2.0 allows remote attackers to read arbitrary files via URLs containing tilde references to home directories, as demonstrated by ro...

Korean GHBoard FlashUpload Component - download.jsp?name Arbitrary File Access

Korean GHBoard FlashUpload Component - download.jsp?name Arbitrary File Access...

Korean GHBoard FlashUpload Component - 'download.jsp?name' Arbitrary File Access

source: https://www.securityfocus.com/bid/26182/info GHBoard is prone to multiple vulnerabilities that let attackers upload and download arbitrary files and execute arbitrary code within the context of the webserver process...