resource: traversal vulnerability

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. dot dot and URL-encoded / slash characters in a resource: URI...

Mozilla Foundation Security Advisory 2008-44

Mozilla Foundation Security Advisory 2008-44 Title: resource: traversal vulnerabilities Impact: Moderate Announced: September 23, 2008 Reporter: Boris Zbarsky, Georgi Guninski Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.0.2 Firefox 2.0.0.17 Thunderbird 2.0.0.17 SeaMonkey 1.1.12...

CVE-2008-4067

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. dot dot and URL-encoded / slash characters in a resource: URI...

Directory traversal

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. dot dot and URL-encoded / slash characters in a resource: URI...

resource: traversal vulnerability

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. dot dot and URL-encoded / slash characters in a resource: URI...

resource: traversal vulnerabilities — Mozilla

Mozilla developer Boris Zbarsky reported that the resource: protocol allowed directory traversal on Linux when using URL-encoded slashes...

Important: Red Hat Security Advisory: jbossweb security update

An updated jbossweb package that fixes various security issues is now available for JBoss Enterprise Application Platform JBoss EAP 4.2 and 4.3. This update has been rated as having important security impact by the Red Hat Security Response Team. JBoss Web Server jbossweb is an enterprise ready w...

CVE-2008-3621

VideoConference in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allows remote attackers to cause a denial of service memory corruption and application crash or execute arbitrary code via vectors involving H.264 encoded media...

CVE-2008-3621

VideoConference in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allows remote attackers to cause a denial of service memory corruption and application crash or execute arbitrary code via vectors involving H.264 encoded media...

CVE-2008-3621

CVE-2008-3621 affects Apple Mac OS X 10.4.11 and 10.5 through 10.5.4, via VideoConference vulnerability in H.264-encoded media. The issue allows remote attackers to trigger memory corruption and an application crash (DoS) or to execute arbitrary code. The provided documents describe the vulnerabl...

Memory corruption

VideoConference in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allows remote attackers to cause a denial of service memory corruption and application crash or execute arbitrary code via vectors involving H.264 encoded media...

CVE-2008-2932

Heap-based buffer overflow in Red Hat adminutil 1.1.6 allows remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code via % percent encoded HTTP input to unspecified CGI scripts in Fedora Directory Server. NOTE: this vulnerability exists because of an incorrec...

PT-2008-4370 · Red Hat · Red Hat Adminutil

Name of the Vulnerable Software and Affected Versions: Red Hat adminutil version 1.1.6 Description: A heap-based buffer overflow issue exists, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via percent encoded HTTP input to unspecified CGI scripts in...

Design/Logic Flaw

Apple QuickTime before 7.5.5 does not properly handle 1 MDAT atoms in MP4 video files within QuickTimeH264.qtx, 2 MDAT atoms in mov video files within QuickTimeH264.scalar, and 3 AVC1 atoms in an unknown media type within an unspecified component, which allows remote attackers to execute arbitrar...

CVE-2008-3627

Apple QuickTime before 7.5.5 does not properly handle 1 MDAT atoms in MP4 video files within QuickTimeH264.qtx, 2 MDAT atoms in mov video files within QuickTimeH264.scalar, and 3 AVC1 atoms in an unknown media type within an unspecified component, which allows remote attackers to execute arbitrar...

QuickTime < 7.5.5 Multiple Vulnerabilities (Mac OS X)

The version of QuickTime installed on the remote Mac OS X host is older than 7.5.5. Such versions contain several vulnerabilities : - Heap and stack-based buffer overflows in the handling of panorama atoms in QTVR QuickTime Virtual Reality movie files could lead to an application crash or arbitra...

CVE-2008-2938

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than...

CVE-2008-2938

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than...

webmail-passwordleak.txt

Name : Horde & Roundcube password leak vulnerability Author : Xc0re Security Reasearch Group Homepage : http://www.xc0re.net Description : Webmail clients such as Horde & Round Cube leak their username and password in a fashion that with every post request they also send a base64 encoded...

mod_jk sends decoded URL to tomcat

modjk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. dot dot sequences and...