CVE-2002-0899

Falcon web server 2.0.0.1021 and earlier is vulnerable to an access-restrictions bypass for protected files when a URL’s directory portion ends with a dot. The flaw allows remote attackers to bypass access controls, potentially exposing protected content. The CVE record repeatedly states the affe...

CVE-2002-0961

Vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier allow remote attackers to conduct unauthorized operations as other users, e.g. by deleting clients via dltclnt.php, possibly in a SQL injection attack...

CVE-2002-0960

CVE-2002-0960 describes multiple cross-site scripting vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier . The flaws allow remote attackers to execute arbitrary script in the context of other CBMS users, implying user-session impact and potential credential exposure via manipulated inputs. The...

CVE-2002-0961

The CVE-2002-0961 entry concerns Voxel Dot Net CBMS 0.7 and earlier. Affected software: Voxel Dot Net CBMS (0.7 and earlier). Vulnerability: remote attackers may perform unauthorized operations as other users, for example deleting clients via dltclnt.php, with potential SQL injection in play. Roo...

CVE-2002-0960

Multiple cross-site scripting vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier allows remote attackers to execute arbitrary script as other CBMS users...

PT-2002-2004 · Care 2002 · Care 2002

Name of the Vulnerable Software and Affected Versions: CARE 2002 versions prior to beta 1.0.02 Description: The issue allows remote attackers to read arbitrary files via .. dot dot sequences and null characters in the lang parameter, which is processed by a call to the include function...

DEBIAN-CVE-2002-0661

Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. dot dot sequences containing \ backslash characters...

CVE-2001-1108

Directory traversal vulnerability in SnapStream PVS 1.2a allows remote attackers to read arbitrary files via a .. dot dot attack in the requested URL...

CVE-2001-1266

Directory traversal vulnerability in Doug Neal's HTTPD Daemon DNHTTPD before 0.4.1 allows remote attackers to view arbitrary files via a .. dot dot attack using the dot hex code '%2E'...

CVE-2001-1295

CVE-2001-1295 is a directory traversal vulnerability in Cerberus FTP Server 1.5 and earlier. The issue allows remote attackers to read arbitrary files by using a .. (dot dot) in the CD command. The available sources confirm the affected software and the traversal nature but do not provide exploit...

CBMS: XSS and SQL Injection holes

CBMS: XSS and SQL Injection holes PROGRAM: CBMS VENDOR: Voxel Dot Net, Inc. [email protected] HOMEPAGE: http://www.voxel.net/projects/cbms/ VULNERABLE VERSIONS: 0.7 and possibly earlier versions as well LOGIN REQUIRED: yes SEVERITY: high VERSION OF THIS ADVISORY: 1.1 DESCRIPTION: "The CBMS is a full...

CVE-2001-1271

Directory traversal vulnerability in rar 2.02 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. dot dot attack on archived filenames...

CVE-2001-1344

WSSecurity.pl in WebStore allows remote attackers to bypass authentication by providing the program with a filename that exists, which is made easier by 1 inserting a null character or 2 .. dot dot...

CVE-2001-1270

Directory traversal vulnerability in the console version of PKZip pkzipc 4.00 and earlier allows attackers to overwrite arbitrary files during archive extraction with the -rec recursive option via a .. dot dot attack on the archived files...

Protected files access in LilHTTP

By using ./ and ../ it's possible to access any files...

CVE-2001-1196

CVE-2001-1196 concerns Webmin 0.91, where a directory traversal flaw in edit_action.cgi could allow privilege escalation via a .. argument. The vulnerability is documented with a high-severity score (CVSS v2: HIGH, base 10.0) and is referenced by multiple sources. A remediation available in the c...

CVE-2001-1217

CVE-2001-1217 describes a directory traversal vulnerability in the PL/SQL Apache module (mod_plsql/mod_plsql) of Oracle 9i Application Server. The issue allows remote attackers to read sensitive files outside the web server’s root by crafting a request with double URL encoded sequences (..). Affe...

CVE-2001-1115

The CVE-2001-1115 issue affects SIX-webboard 2.01 and earlier where generate.cgi does not properly validate the content parameter, allowing a remote attacker to perform directory traversal and read arbitrary files on the server with the web server’s permissions. This is caused by directory traver...

CVE-2002-0144

CVE-2002-0144 is a directory traversal vulnerability in chuid 1.2 and earlier that allows remote attackers to change ownership of files outside the upload directory via a .. path traversal. Affected: chuid 1.2 and earlier. Impact: unauthorized ownership changes; remote exploitation. Exploit detai...

CVE-2001-1010

CVE-2001-1010 affects Sambar Server’s pagecount CGI script (located at /session/pagecount). The vulnerability arises because the page parameter is not validated against directory traversal (".."), enabling a remote attacker to overwrite arbitrary files on the filesystem. The root cause is lack of...