phpGedView_v2.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PHP Code Injection Vulnerabilities in phpGedView 2.65.1 and prior Summary : phpGedView is an open source system for online viewing Gedcom information family tree and genology information. Multiple PHP Code Injection vulnerabilities exist in the...

[Full-Disclosure] Directory Traversal in Accipiter Direct Server 6.0

Severity: High Title: Accipiter Direct Server Date: January 09, 2004 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== A security vulnerability has been found in Accipiter Direct...

QuikStore Shopping Cart quikstore.cgi template Parameter Traversal Arbitrary File Access

The CGI 'quickstore.cgi' is installed. This CGI has a well known security flaw that lets an attacker read arbitrary files with the privileges of the HTTP daemon. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: Date: Tue, 23 Dec 2003 20:27:51 +0800 From: DrPonidi Haryanto Subject:...

CVE-2003-1545

Absolute path traversal vulnerability in nukestyles.com viewpage.php addon for PHP-Nuke allows remote attackers to read arbitrary files via a full pathname in the file parameter. NOTE: This was originally reported as an issue in PHP-Nuke 6.5, but this is an independent addon...

CVE-2003-0832

Directory traversal vulnerability in webfs before 1.20 allows remote attackers to read arbitrary files via .. dot dot sequences in a Hostname header...

myPHPNuke phptonuke.php filnavn Parameter Traversal Arbitrary File Access

The version of myPHPNuke installed on the remote host allows anyone to read arbitrary files by passing the full filename to the 'filnavn' argument of the 'phptonuke.php' script. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Status: it was not tested against a vulnerable host, and the...

CVE-2003-0676

Directory traversal vulnerability in ViewLog for iPlanet Administration Server 5.1 aka Sun ONE allows remote attackers to read arbitrary files via "..%2f" partially encoded dot dot sequences...

WebCalendar long.php user_inc Parameter Traversal Arbitrary File Access

The remote installation of WebCalendar may allow an attacker to read arbitrary files on the remote host by supplying a filename to the 'userinc' argument of the file 'long.php'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

CVE-2003-0536

Directory traversal vulnerability in phpSysInfo 2.1 and earlier allows attackers with write access to a local directory to read arbitrary files as the PHP user or cause a denial of service via .. dot dot sequences in the 1 template or 2 lng parameters...

WebJeff FileManager 1.6 - File Disclosure

source: https://www.securityfocus.com/bid/7995/info A vulnerability has been reported for Filemanager that may result in the disclosure of arbitrary files. The vulnerability exists due to insufficient sanitization of user-supplied values for URI parameters. A malicious attacker can specify...

rot13sj.cgi Arbitrary File Access

The remote host is running the CGI 'rot13sj.cgi'. This CGI contains various flaws which may allow a user to execute arbitrary commands on this host and to read aribrary files. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: http://www.geocities.com/sjefferson101010/ link is broken...

Multiple FTP Server quote stat Command Traversal Arbitrary Directory Access

The remote FTP server is vulnerable to a flaw that allows users to access files outside the FTP server root. An attacker may break out of his FTP jail by issuing the command : ftp quote stat ../ Some versions of VisNetic FTP Server and Titan FTP Server are known to be affected by this issue. C...

Super-M Son hServer URI Traversal Arbitrary File Access

Super-M Son hServer is vulnerable to a directory traversal. It enables a remote attacker to view any file on the computer with the privileges of the web server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include 'compat.inc' ; ifdescription scriptid11678; scriptversion"1.22";...

ST FTP Service Arbitrary File/Directory Access

The remote FTP server is vulnerable to a flaw that allows users to access files that are outside the FTP server root. An attacker may break out of his FTP jail by issuing the command : CWD C: TRUSTED...

WsMp3 Daemon (WsMp3d) HTTP Traversal Arbitrary File Execution/Access

The remote host is using wsmp3d, an MP3 streaming web server. There is a flaw in this server that allows anyone to execute arbitrary commands and read arbitrary files with the privileges this server is running with. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid1164...

BadBlue ISAPI Extension ext.dll LoadPage Parameter Arbitrary File Access

The remote host is running BadBlue web server earlier then 2.3. Such versions are reportedly affected by an authentication bypass vulnerability. A flaw in the order that security checks are performed could allow an attacker to gain administrative access to the application. C Tenable Network...

CVE-2002-1562

Directory traversal vulnerability in thttpd, when using virtual hosting, allows remote attackers to read arbitrary files via .. dot dot sequences in the Host: header...

Multiple Vulnerabilities in SLWebmail

NGSSoftware Insight Security Research Advisory Name: Multiple Vulnerabilities in SLWebMail Systems Affected: SLWebMail 3 on Windows Severity: High Risk Vendor URL: http://www.slmail.com Authors: David Litchfield [email protected] Mark Litchfield [email protected] Date: 7th May 2003 Advisor...

thttpd Host Header Traversal Arbitrary File Access

The remote HTTP server allows anyone to browse the files on the remote host by sending HTTP requests with a Host: field set to '../../'. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11576; scriptversion "1.18"; scriptcveid"CVE-2002-1562", "CVE-2003-0899";...

Nokia IPSO Voyager WebGUI readfile.tcl file Parameter Arbitrary File Access

The remote host includes a CGI /cgi-bin/readfile.tcl which allows anyone to read arbitrary files on the remote host with the privileges of the HTTP daemon typically 'nobody'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: From: Jonas Eriksson mailto:[email protected] Date: 23/04/2003 To:...