Design/Logic Flaw

Unspecified vulnerability in the XML feature in IBM DB2 9.7 before FP6 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary XML files via unknown vectors...

PT-2012-2808

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.7 before FP6 Description The issue allows remote authenticated users to read arbitrary XML files. Recommendations For IBM DB2 version 9.7, update to FP6 or later to resolve the issue...

CVE-2012-0713: Undefined Security Weakness

Unspecified vulnerability in the XML feature in IBM DB2 9.7 before FP6 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary XML files via unknown vectors...

PT-2012-3873

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.1 before FP12 IBM DB2 versions 9.5 through FP9 IBM DB2 versions 9.7 through FP6 IBM DB2 versions 9.8 through FP5 IBM DB2 versions 10.1 Description The issue allows remote attackers to read arbitrary XML files. This is achiev...

Skype Extras Manager (skypePM.exe) skype-plugin: URI Arbitrary XML File Deletion (credentialed check)

According to its timestamp, the version of Skype installed on the remote host likely includes a version of the Skype Extras Manager skypePM.exe that has a flaw in its handling of the 'skype-plugin:' protocol. If an attacker can trick a user on the affected system into clicking on a specially...

NextApp Echo < 2.1.1 - XML Injection

SEC Consult Security Advisory ======================================================================== title: NextApp Echo XML Injection Vulnerability program: NextApp Echo vulnerable version: Echo2 2.1.1 homepage: http://echo.nextapp.com/site/echo2 found: Feb. 2008 by: Anonymous / SEC Consult...

Design/Logic Flaw

The request handler in JBossWS in JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read...

CVE-2006-4550

Directory traversal vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to read arbitrary XML files via .. dot dot sequences in the format parameter with a leading ".", which bypasses a security check...

CVE-2006-4550

Directory traversal vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to read arbitrary XML files via .. dot dot sequences in the format parameter with a leading ".", which bypasses a security check...

CVE-2006-0275

Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 has unspecified impact and attack vectors, as identified by Oracle Vuln REP04. NOTE: Oracle has not disputed reliable researcher claims that this issue is related to directory traversal that...