3798 matches found
Mandrake Linux Security Advisory : wget (MDKSA-2005:098)
Two vulnerabilities were found in wget. The first is that an HTTP redirect statement could be used to do a directory traversal and write to files outside of the current directory. The second is that HTTP redirect statements could be used to overwrite dot '.' files, potentially overwriting the...
CVE-2004-2121: Undefined Security Weakness
Multiple directory traversal vulnerabilities in Borland Web Server BWS 1.0b3 and earlier allow remote attackers to read and download arbitrary files via 1 multi-dot "......" sequences, or 2 "%5c%2e%2e" encoded ".." sequences, in the URL...
CVE-2005-1659
Cross-site scripting XSS vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to inject arbitrary Javascript via a URL with a "..." triple dot followed by an onmouseover event...
DEBIAN-CVE-2005-1229
Directory traversal vulnerability in cpio 2.6 and earlier allows remote attackers to write to arbitrary directories via a .. dot dot in a cpio file...
DEBIAN-CVE-2005-0437
Directory traversal vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to include arbitrary Perl modules via .. dot dot sequences in the loadplugin parameter...
DEBIAN-CVE-2005-0837
IceCast 2.20 allows remote attackers to bypass the XSL parser and obtain the source for XSL files via a request for a .xsl file with a trailing . dot...
DEBIAN-CVE-2004-1487
wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a redirection URL containing a ".." that resolves to the IP address of the malicious server, which bypasses wget's filtering for ".." sequences...
CVE-2005-0622: Undefined Security Weakness
RaidenHTTPD 1.1.32, and possibly other versions before 1.1.34, allows remote attackers to view the PHP source code via an HTTP GET request for a filename with a trailing 1 . dot or 2 space...
PT-2005-1333 · Biborb · Biborb
Name of the Vulnerable Software and Affected Versions: BibORB versions 1.3.2 and earlier Description: The issue allows remote attackers to delete arbitrary files via a Delete action and .. dot dot sequences in the database name parameter in index.php. Recommendations: For BibORB versions 1.3.2 an...
security flaw
Multiple buffer overflows in gram.y for PostgreSQL 8.0.1 and earlier may allow attackers to execute arbitrary code via 1 a large number of variables in a SQL statement being handled by the readsqlconstruct function, 2 a large number of INTO variables in a SELECT statement being handled by the...
security flaw
Directory traversal vulnerability in the truepath function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences...
CVE-2005-0329
Directory traversal vulnerability in ZipGenius 5.5 and earlier allows remote attackers to create and possibly modify arbitrary files via a ZIP file with a file whose name includes .. dot dot sequences...
DEBIAN-CVE-2004-0916
Directory traversal vulnerability in cabextract before 1.1 allows remote attackers to overwrite arbitrary files via a cabinet file containing .. dot dot sequences in a filename...
PT-2004-2358
Name of the Vulnerable Software and Affected Versions: Roundup versions 0.6.4 and earlier Description: The issue allows remote attackers to view arbitrary files via .. dot dot sequences in an @@ command in an HTTP GET request. This enables access to sensitive information. Recommendations: For...
CVE-2004-1281: Undefined Security Weakness
The ftpretr function in junkie 0.3.1 allows remote malicious FTP servers to overwrite arbitrary files via .. dot dot sequences in a filename...
PT-2004-2059 · Apache +1 · Apache +1
Name of the Vulnerable Software and Affected Versions: Apache for Apple Mac OS X versions 10.2.8 and 10.3.6 Description: The issue arises from the difference in how Apache and the Apple HFS+ filesystem handle file access in terms of case sensitivity. Apache restricts access to files in a...
PT-2004-1119 · Unarj · Unarj
Name of the Vulnerable Software and Affected Versions: unarj affected versions not specified Description: The issue is related to a directory traversal vulnerability in the -x extract command line option. This vulnerability allows remote attackers to overwrite arbitrary files by using an arj...
CVE-2002-1385
openwebmailinit in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. dot dot sequences in a login name, such as the name provided in the sessionid parameter for openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be...
VulnCheck KEV: CVE-2003-1041
Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." dot dot sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug ma...