2415 matches found
CVE-2007-6506
The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlier, including 3.0.8.4, allows remote attackers to 1 overwrite and corrupt arbitrary files via arguments to the SaveToFile method, and possibly 2 access arbitrary files via the...
CVE-2007-6212
CVE-2007-6212: Directory traversal in region.php of KML share 1.1 lets remote attackers read arbitrary server files by passing ".." in the layer parameter. Affected: KML share 1.1 (region.php). Root cause: improper validation leading to directory traversal. Impact: partial confidentiality breach ...
2007-06 Sentinel Protection Server Directory Traversal
Title ----- Sentinel Protection Server Directory Traversal Severity -------- High Date Discovered --------------- October 10th, 2007 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: Corey Lebleu Vulnerability Description ------------------------- A classic...
Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : firefox vulnerabilities (USN-535-1)
Various flaws were discovered in the layout and JavaScript engines. By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user's privileges. CVE-2007-5336, CVE-2007-5339, CVE-2007-5340 Michal Zalewski discovered that the onUnload event handlers we...
CVE-2004-2745
The CVE-2004-2745 entry describes a directory traversal vulnerability in Anteco Visual Technologies OwnServer 1.0 and earlier, allowing remote attackers to read arbitrary files via a .. sequence in a URL. Affected component: OwnServer (version 1.0 and earlier). Underlying cause and exact root cau...
Design/Logic Flaw
httpd.tkd in Radia Integration Server in Hewlett-Packard HP OpenView Configuration Management CM Infrastructure 4.0 through 4.2i and Client Configuration Manager CCM 2.0 allows remote attackers to read arbitrary files via URLs containing tilde references to home directories, as demonstrated by ro...
Korean GHBoard FlashUpload Component - download.jsp?name Arbitrary File Access
Korean GHBoard FlashUpload Component - download.jsp?name Arbitrary File Access...
Korean GHBoard FlashUpload Component - 'download.jsp?name' Arbitrary File Access
source: https://www.securityfocus.com/bid/26182/info GHBoard is prone to multiple vulnerabilities that let attackers upload and download arbitrary files and execute arbitrary code within the context of the webserver process...
SiteBar 3.3.8 - 'translator.php?dir' Traversal Arbitrary File Access
source: https://www.securityfocus.com/bid/26126/info SiteBar is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input. These issues include: - A local file-include vulnerability - Multiple arbitrary-script-code-execution vulnerabilities -...
CVE-2003-1365
The escapedangerouschars function in CGI::Lite 2.0 and earlier does not correctly remove special characters including 1 "" backslash, 2 "?", 3 "" tilde, 4 "^" carat, 5 newline, or 6 carriage return, which could allow remote attackers to read or write arbitrary files, or execute arbitrary commands...
CVE-2002-2240
CVE-2002-2240 affects MyServer 0.11 and 0.2, where a directory traversal vulnerability allows remote attackers to read arbitrary files via ".." in an HTTP GET. The issue stems from improper handling of path traversal, enabling access to files outside the web root. The NVD entry lists a CVSSv2 bas...
java-jre: Applet Privilege Escalation
The Java Virtual Machine JVM in Sun Java Runtime Environment JRE in SDK and JRE 1.3.x through 1.3.120 and 1.4.x through 1.4.215, and JDK and JRE 5.x through 5.0 Update 12 and 6.x through 6 Update 2, allows remote attackers to execute arbitrary programs, or read or modify arbitrary files, via...
Cart32 c32web.exe ImageName Traversal Arbitrary File Access
Cart32, a shopping cart application, is installed on the remote host. The remote installation of Cart32 fails to sufficiently validate input to the 'GetImage' function of 'c32web.exe' script before returning the contents of arbitrary files, not just image files as intended. An unauthenticated,...
Resin for Windows \WEB-INF Traversal Arbitrary File Access
The remote host is running Resin, an application server. The installation of Resin on the remote host allows an unauthenticated, remote attacker to gain access to the web-inf directories, or any known subdirectories, on the affected Windows host, which could lead to a loss of confidentiality. C...
Caucho Resin 3.1 - web-inf Traversal Arbitrary File Access
Caucho Resin 3.1 - web-inf Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/23985/info Caucho Resin is prone to multiple information-disclosure vulnerabilities because it fails to adequately sanitize user-supplied data. Attackers can exploit these issues to access...
Caucho Resin 3.1 - '/web-inf' Traversal Arbitrary File Access
source: https://www.securityfocus.com/bid/23985/info Caucho Resin is prone to multiple information-disclosure vulnerabilities because it fails to adequately sanitize user-supplied data. Attackers can exploit these issues to access potentially sensitive data that may aid in further attacks. Resin...
Plesk Multiple Script locale_id Parameter Traversal Arbitrary File Access
The remote host is running Plesk, a control panel used to administer and manage websites. The version of Plesk installed on the remote host fails to sanitize user-supplied input to the 'localeid' parameter of the 'login.php3', 'loginup.php', and 'top.php3' scripts before using it to access files...
CVE-2007-2200
CVE-2007-2200 affects Pagode 0.5.8, where a directory traversal flaw in navigator/navigator_ok.php allows remote attackers to read—and possibly delete—arbitrary files by supplying a .. sequence in the asolute parameter. The vulnerability’s impact is read and potential deletion of files; no exploi...
LedgerSMB / SQL-Ledger file Parameter Multiple Vulnerabilities
The remote host is running LedgerSMB or SQL-Ledger, a web-based double-entry accounting system. The version of LedgerSMB or SQL-Ledger on the remote host fails to properly sanitize the 'file' parameter of the 'am.pl' script before using it in various template routines in the 'AM.pm' module. An...