2417 matches found
PHP mylog.html/mlog.html read arbitrary file
The remote host is running PHP/FI. The remote version of this software contains a flaw in the files mylog.html/mlog.html than can allow a remote attacker to view arbitrary files on the remote host. OpenVAS Vulnerability Test $Id: phparbitraryfileaccess.nasl 5781 2017-03-30 08:15:57Z cfi $...
IlohaMail Arbitrary File Access via Session Variable Vulnerability
The target is running at least one instance of IlohaMail version 0.7.11 or earlier. Such versions contain a flaw in the processing of the session variable that allows an unauthenticated attacker to retrieve arbitrary files available to the web user, provided the filesystem backend is in use...
IlohaMail Arbitrary File Access via Language Variable
The target is running at least one instance of IlohaMail version 0.7.10 or earlier. Such versions contain a flaw in the processing of the language variable that allows an unauthenticated attacker to retrieve arbitrary files available to the web user. SPDX-FileCopyrightText: 2004-2005 George A...
CuteNews 1.4.1 - template Traversal Arbitrary File Access
CuteNews 1.4.1 - template Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/15295/info CuteNews is affected by a directory traversal vulnerability. An unauthorized attacker can retrieve or upload arbitrary files by supplying directory traversal strings '../' through an...
CuteNews 1.4.1 - 'show_archives.php' Traversal Arbitrary File Access
source: https://www.securityfocus.com/bid/15295/info CuteNews is affected by a directory traversal vulnerability. An unauthorized attacker can retrieve or upload arbitrary files by supplying directory traversal strings '../' through an affected URI parameter. Exploitation of this vulnerability...
ATutor < 1.5.1-pl1 Multiple Remote Vulnerabilities (XSS, RFI, Command Exe)
The remote host is running ATutor, an open source, web-based Learning Content Management System LCMS written in PHP. The version of ATutor installed on the remote host may be vulnerable to arbitrary command execution, arbitrary file access, and cross-site scripting attacks. Successful exploitatio...
Gallery main.php g2_itemId Parameter Traversal Arbitrary File Access
The version of Gallery hosted on the remote web server fails to sanitize user-supplied input to the 'g2itemId' parameter of the 'main.php' script before using it to read cached files. If PHP's 'displayerrors' setting is enabled, an attacker can exploit this flaw to read arbitrary files on the...
Polipo < 0.9.9 Unspecified Traversal Arbitrary File Access
The remote host is running the Polipo caching web proxy. In addition to caching web pages, the software also functions as a web server for providing access to documentation, cached pages, etc. The built-in web server in the installed version of Polipo fails to filter directory traversal sequences...
3Com Network Supervisor Traversal Arbitrary File Access
The remote host is running 3Com Network Supervisor, a network monitoring application. The version of 3Com Network Supervisor installed on the remote host is prone to a directory traversal attack and, as such, allows an unauthenticated attacker to read arbitrary files on the same filesystem as the...
PHPMyFAQ 1.5.1 - Local File Inclusion
source: https://www.securityfocus.com/bid/14929/info PHPMyFAQ is prone to a local file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary server-side script code that resides o...
w-Agora index.php site Parameter Traversal Arbitrary File Access
The remote host is running w-agora, a web-based forum application written in PHP. The remote version of this software is prone to directory traversal attacks. A remote attacker could request a specially crafted URL to read arbitrary files on the remote system with the privileges of the web server...
W-Agora < 4.2.1 index.php site Parameter Traversal Arbitrary File Access
Binary data 3171.prm...
Atomic Photo Album apa_phpinclude.inc.php apa_module_basedir Parameter Remote File Inclusion
The remote host is running Atomic Photo Album, a free, PHP-based photo gallery. The installed version of Atomic Photo Album allows remote attackers to control the 'apamodulebasedir' variable used when including PHP code in the 'apaphpinclude.inc.php' script. By leveraging this flaw, an attacker m...
webadmin.php show Parameter Arbitrary File Access
webadmin.php was found on your web server. In its current configuration, this file manager CGI gives access to the whole filesystem of the machine to anybody. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription scriptid18586;...
Apple Keynote Presentation < 2.0.2 keynote: URI Handler Arbitrary File Access
The remote host contains a version of Keynote 2 which is older than 2.0.2. The installed version is affected by a security issue which may allow an attacker to send a rogue keynote file containing malformed URI links in it. An attacker can exploit this issue to read and upload arbitrary local fil...
PostNuke 0.75/0.76 Blocks Module - Directory Traversal
source: https://www.securityfocus.com/bid/13636/info PostNuke Blocks module is affected by a directory traversal vulnerability. The problem presents itself when an attacker passes a name for a target file, along with directory traversal sequences, to the affected application. An attacker may...
TFTP Traversal Arbitrary File Access
The TFTP Trivial File Transfer Protocol server running on the remote host is vulnerable to a directory traversal attack that allows an attacker to read arbitrary files on the remote host by prepending their names with directory traversal sequences. %NASLMINLEVEL 70300 C Tenable Network Security,...
NETFile FTP/Web Server Directory Traversal Arbitrary File Access
The version of NETFile FTP/Web server installed on the remote host is prone to directory traversal attacks. Specifically, an attacker can create directories outside the server's folder path with a specially crafted URL. The attacker may also be able to delete arbitrary files and directories on th...
RaidenFTPD urlget Command Traversal Arbitrary File Access
The remote host is running the RaidenFTPD FTP server. This version has a directory traversal vulnerability that could allow an attacker to read arbitrary files outside of the intended FTP root. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid18225; scriptversion"1.18"...