openSUSE Security Update : java-1_6_0-openjdk (openSUSE-SU-2010:0553-1)

icedtea included in java-160-openjdk was updated to version 1.8.1 which fixes two security issues : CVE-2010-2783: IcedTea 'Extended JNLP Services' arbitrary file access CVE-2010-2548: IcedTea Incomplete property access check for unsigned applications The new version also fixes many non-security...

Open-Realty index.php select_users_lang Parameter Traversal Local File Inclusion

The web server hosts Open-Realty, a web-based real estate listing management application written in PHP. At least one install of Open-Realty on the remote host fails to sanitize user-supplied input to the 'selectuserslang' parameter in POST requests to the 'index.php' script before using it to...

Cisco Plugs Code Execution Hole in CDS Internet Streamer

Cisco has shipped a critical bulletin to warn about a serious security hole in the Cisco Internet Streamer application, which is part of the Cisco Content Delivery System. In an advisory, Cisco warned that exploitation of this vulnerability may allow a remote, unauthenticated attacker to obtain...

Joomla! Component Percha Image Attach 1.1 - 'Controller' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/40244/info Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to obtain potentially sensitive information...

Joomla! Component Percha Image Attach 1.1 - Controller Traversal Arbitrary File Access

Joomla! Component Percha Image Attach 1.1 - Controller Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/40244/info Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input. An...

Joomla! Component Percha Fields Attach 1.0 - Controller Traversal Arbitrary File Access

Joomla! Component Percha Fields Attach 1.0 - Controller Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/40244/info Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input. A...

Joomla! Component Percha Multicategory Article 0.6 - Controller Arbitrary File Access

Joomla! Component Percha Multicategory Article 0.6 - Controller Arbitrary File Access source: https://www.securityfocus.com/bid/40244/info Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input. An...

Joomla! Component Percha Fields Attach 1.0 - 'Controller' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/40244/info Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to obtain potentially sensitive information...

CVE-2009-4726

CVE-2009-4726: A directory traversal vulnerability in Quickdev 4 PHP, in download.php, allows remote attackers to read arbitrary files by supplying .. in the file parameter. The issue affects Quickdev 4 PHP’s download functionality and is documented with CVSS v2 base score 5.0 (Medium) and networ...

CVE-2009-4700

The CVE-2009-4700 entry concerns SkaDate Dating. Affected component: index.php handling the layout parameter. Root cause: directory traversal via a .. sequence in layout, enabling remote attackers to read arbitrary files. The NVD/NVD-derived records confirm this behavior and report a medium base ...

SUPERAntiSpyware 4.34.1000 and SuperAdBlocker 4.6.1000 - Multiple Vulnerabilities

SUPERAntiSpyware 4.34.1000 and SuperAdBlocker 4.6.1000 - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/38645/info SUPERAntiSpyware and Super Ad Blocker are prone to multiple local vulnerabilities, including: - Multiple denial-of-service vulnerabilities - Multiple local...

Accellion File Transfer - Appliance web_client_user_guide.html?lang Traversal Arbitrary File Access

Accellion File Transfer - Appliance webclientuserguide.html?lang Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/38176/info Accellion File Transfer Appliance is prone to multiple remote vulnerabilities, including: - Multiple privilege-escalation issues - A...

Accellion File Transfer - 'Appliance web_client_user_guide.html?lang' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/38176/info Accellion File Transfer Appliance is prone to multiple remote vulnerabilities, including: - Multiple privilege-escalation issues - A directory-traversal issue - An HTML-injection issue - A remote command-injection issue An attacker may leverage...

Samba Symlink Traversal Arbitrary File Access (unsafe check)

The remote Samba server is configured insecurely and allows a remote attacker to gain read or possibly write access to arbitrary files on the affected host. Specifically, if an attacker has a valid Samba account for a share that is writable or there is a writable share that is configured to be a...

Insufficient User Input Validation in VP-ASP 6.50 Demo Code

======================================================================== = CodeScan Advisory, codescan.com [email protected] = = Insufficient User Input Validation in VP-ASP 6.50 Demo Code = = Vendor Website: = http://www.vpasp.com/ = = Affected Version: = VP-ASP Shopping Cart 6.50 Demo Cod...

SugarCRM on Apache / Windows .htaccess Direct Request Arbitrary File Access

The version of SugarCRM running on the remote host has an information disclosure vulnerability. When Apache is running on Windows, .htaccess restrictions are case-sensitive, but filenames are not. A remote attacker can bypass .htaccess restrictions by using uppercase letters when requesting files...

PHP168后台查看/修改任意文件漏洞

No description provided by source...

Directory traversal

Directory traversal vulnerability in image.php in Clear Content 1.1 allows remote attackers to read arbitrary files via a .. dot dot in the url parameter. NOTE: the researcher also suggests an analogous PHP remote file inclusion vulnerability, but this may be incorrect...

SuSE 10 Security Update : compat-curl2 (ZYPP Patch Number 6408)

This update of libcurl2 fixes the 0-character handling in the subject name of a SSL certificate. This bug could be used to execute an undetected man-in-the-middle-attack. CVE-2009-2417 Additionally the arbitrary file access problem was fixed. CVE-2009-0037 %NASLMINLEVEL 70300 C Tenable Network...

SuSE 11 Security Update : curl (SAT Patch Number 634)

Arbitrary file access via HTTP-redirect has been fixed in curl. CVE-2009-0037 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C...