2415 matches found
NeoSys Neon Webmail for Java 5.06/5.07 - 'downloadfile' Servlet Traversal Arbitrary File Access
source: https://www.securityfocus.com/bid/20109/info Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include: - an arbitrary-file-upload vulnerability - an arbitrary-email-manipulation vulnerability - multiple...
CVE-2006-4878
The CVE-2006-4878 issue affects PHPp (David Bennett PHP-Post) 1.0 and earlier, with a directory traversal vulnerability in footer.php. A remote attacker can read arbitrary local files by manipulating the template parameter to include a .. sequence. The note indicates exposure was later reported t...
Site@School Multiple Script cmsdir Parameter Remote File Inclusion
The remote host is running Site@School, an open source, PHP-based, content management system intended for primary schools. The version of Site@School installed on the remote host fails to sanitize input to the 'cmsdir' parameter before using it to include PHP code in several scripts. Provided PHP...
PHProg 1.0 - 'index.php?lang' Traversal Arbitrary File Access
source: https://www.securityfocus.com/bid/19957/info PHProg is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data and may allow an attacker to carry out cross-site scripting and local file-include attacks. Version 1.0 of PHProg is reported...
CubeCart < 3.0.13 Multiple Vulnerabilities
Binary data 3736.prm...
WebAdmin < 3.2.5 Multiple Vulnerabilities
The remote host is running WebAdmin, a web-based remote administration tool for Alt-N MDaemon. According to its banner, the installed version of WebAdmin fails to properly filter directory traversal sequences from the 'file' parameter of the 'logfileview.wdm' and 'configfileview.wdm' scripts. A...
IPCheck Server Monitor < 5.3.3.639 Traversal Arbitrary File Access
Binary data 3723.prm...
IPCheck Server Monitor Traversal Arbitrary File Access
The remote host is running IPCheck Server Monitor, a network resource monitoring tool for Windows. The installed version of IPCheck Server Monitor fails to filter directory traversal sequences from requests that pass through web server interface. An attacker can exploit this issue to read arbitra...
Hobbit Monitor config Method Traversal Arbitrary File Access
The version of the Hobbit Monitor daemon installed on the remote host does not properly filter the argument to the 'config' command of directory traversal sequences. An unauthenticated attacker can leverage this flaw to retrieve arbitrary files from the affected host subject to the privileges of...
IceWarp < 5.6.1 lang_settings Parameter Remote File Inclusion (deprecated)
Binary data 3688.prm...
WinSCP URI Handler Arbitrary File Access
According to its version, the WinSCP install on the remote host allows a remote attacker to automatically initiate a file transfer to or from the affected host or to append log information to an existing file, provided that the user can be tricked into clicking on a malicious link. C Tenable...
security flaw
KDE Display Manager KDM in KDE 3.2.0 up to 3.5.3 allows local users to read arbitrary files via a symlink attack related to the session type for login...
WinSCP 3.8.1 - URI Handler Arbitrary File Access
WinSCP 3.8.1 - URI Handler Arbitrary File Access source: https://www.securityfocus.com/bid/18384/info WinSCP is prone to an arbitrary file-access vulnerability. An attacker can exploit this issue to upload arbitrary files to a victim user's computer or to download arbitrary files from the victim'...
WinSCP 3.8.1 - URI Handler Arbitrary File Access
source: https://www.securityfocus.com/bid/18384/info WinSCP is prone to an arbitrary file-access vulnerability. An attacker can exploit this issue to upload arbitrary files to a victim user's computer or to download arbitrary files from the victim's computer in the context of the vulnerable...
wodSFTP ActiveX Arbitrary File Access
The Windows remote host contains the wodSFTP ActiveX control, which provides SFTP functionality to applications that use it and is marked as 'safe for scripting'. A remote attacker may be able to use this control to store files on the remote filesystem or retrieve files from it by means of a...
Resin viewfile Servlet Arbitrary File Disclosure
The remote host is running Resin, an application server. The installation of Resin on the remote host includes a servlet, named 'viewfile', that lets an unauthenticated, remote attacker view any file within the web root directory on the affected host. This could lead to a loss of confidentiality...
Design/Logic Flaw
The ActiveX version of FrontRange iHEAT allows remote authenticated users to run arbitrary programs or access arbitrary files on the host machine by uploading a file with an extension that is not associated with an application, and selecting a file from the "Open With..." dialog...
sa-caucho.txt
ScanAlert Security Advisory http://www.scanalert.com Caucho Resin Multiple Vulnerabilities - Arbitrary File Access & Information Disclosure Date: 5/16/06 Vendor: Caucho Package: Resin Version: 3.0.17 and 3.0.18 Vendor Confirmed Credit: ScanAlerts Security and Enterprise Services Teams. Risk:...
ScanAlert Security Advisory
ScanAlert Security Advisory http://www.scanalert.com Caucho Resin Multiple Vulnerabilities - Arbitrary File Access & Information Disclosure Date: 5/16/06 Vendor: Caucho Package: Resin Version: 3.0.17 and 3.0.18 – Vendor Confirmed Credit: ScanAlert’s Security and Enterprise Services Teams. Risk:...
Asterisk Recording Interface (ARI) misc/audio.php recording Parameter Traversal Arbitrary File Access
The remote host is running Asterisk Recording Interface ARI, a web-based portal for the Asterisk PBX software. The version of ARI installed on the remote host reportedly allows an unauthenticated attacker to retrieve arbitrary sound files, such as voicemail messages, and to determine the existenc...