Directory traversal

Multiple directory traversal vulnerabilities in IZArc Archiver 3.5 beta 3 allow remote attackers to write arbitrary files via a ..\ dot dot backslash in a 1 .rar, 2 .tar, 3 .zip, 4 .jar, or 5 .gz archive. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2006-1715

The CVE-2006-1715 entry concerns Christian Kindahl TugZip (versions 3.4.0.0, 3.3.0.0, 3.1.0.2). The vulnerability arises in archive extraction where a dot-dot (..) path in a crafted archive pack (formats: .gz, .jar, .rar, or .zip) can lead to directory traversal, enabling a user‑assisted attacker...

TUGZip Archive Extraction Directory traversal

TUGZip Archive Extraction Directory traversal TUGZip is a powerful award-winning freeware archiving utility for WindowsA® that provides support for a wide range of compressed, encoded and disc-image files, as well as many other very powerful features; all through an easy to use application...

Directory traversal

Directory traversal vulnerability in SpeedProject Squeez 5.1, as used in 1 ZipStar 5.1 and 2 SpeedCommander 11.01.4450, allows remote attackers to overwrite arbitrary files via unspecified manipulations in a 1 JAR or 2 ZIP archive...

CVE-2006-0890

Directory traversal vulnerability in SpeedProject Squeez 5.1, as used in 1 ZipStar 5.1 and 2 SpeedCommander 11.01.4450, allows remote attackers to overwrite arbitrary files via unspecified manipulations in a 1 JAR or 2 ZIP archive...

KLA10339 WLF vulnerability in SpeedProject

A directory traversal vulnerability was found in SpeedProject products. By exploiting this vulnerability malicious users can overwrite local files. This vulnerability can be exploited remotely at a point related to the JAR and ZIP archives. Original advisories - Related products...

CVE-2005-4804

Unspecified vulnerability in Sun Java System Application Server Platform Edition and Enterprise Edition 8.1 2005 Q1, and Platform Edition UR1, allows remote attackers to read .jar files via unknown vectors related to deployed web applications...

CVE-2003-1229

X509TrustManager in 1 Java Secure Socket Extension JSSE in SDK and JRE 1.4.0 through 1.4.001, 2 JSSE before 1.0.3, 3 Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and 4 Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in...

CVE-2003-1229

The issue concerns X509TrustManager in Java Secure Socket Extension (JSSE) across multiple Java platforms (SDK/JRE 1.4.0–1.4.0_01, JSSE before 1.0.3, Java Plug‑in SDK/JRE 1.3.0–1.4.1, and Java Web Start 1.0–1.2). The X509TrustManager incorrectly calls isClientTrusted when determining server trust...

FreeBSD : jdk -- jar directory traversal vulnerability (18e5428f-ae7c-11d9-837d-000e0c2e438a)

Pluf has discovered a vulnerability in Sun Java JDK/SDK, which potentially can be exploited by malicious people to compromise a user's system. The jar tool does not check properly if the files to be extracted have the string '../' on its names, so it's possible for an attacker to create a malicio...

FreeBSD : mozilla -- 'Wrapped' javascript: urls bypass security checks (a81746a1-c2c7-11d9-89f7-02061b08fc24)

A Mozilla Foundation Security Advisory reports : Some security checks intended to prevent script injection were incorrect and could be bypassed by wrapping a javascript: url in the view-source : pseudo-protocol. Michael Krax demonstrated that a variant of his favicon exploit could still execute...

CVE-2002-1796

ChaiVM EZloader for HP color LaserJet 4500 and 4550 and HP LaserJet 4100 and 8150 does not properly verify JAR signatures for new services, which allows local users to load unauthorized Chai services...

CVE-2002-1796

The CVE-2002-1796 issue affects ChaiVM EZloader for HP Color LaserJet 4500/4550 and HP LaserJet 4100/8150, where JAR signatures are not properly verified for new services. This allows local users to load unauthorized Chai services via the EZloader component. The vulnerability is documented across...

CVE-2002-1796

ChaiVM EZloader for HP color LaserJet 4500 and 4550 and HP LaserJet 4100 and 8150 does not properly verify JAR signatures for new services, which allows local users to load unauthorized Chai services...

CVE-2005-1080

Directory traversal vulnerability in the Java Archive Tool Jar utility in J2SE SDK 1.4.2 and 1.5, and OpenJDK, allows remote attackers to create or overwrite arbitrary files via a .. dot dot in filenames in a .jar file...

CVE-2005-1080

Directory traversal vulnerability in the Java Archive Tool Jar utility in J2SE SDK 1.4.2 and 1.5, and OpenJDK, allows remote attackers to create or overwrite arbitrary files via a .. dot dot in filenames in a .jar file...

CVE-2005-1080

The CVE-2005-1080 entry concerns a directory traversal vulnerability in the jar utility of the Java Archive Tool (Jar) used by J2SE SDK 1.4.2/1.5 and OpenJDK. The underlying issue allows a remote attacker to create or overwrite arbitrary files via a .. sequence in filenames stored inside a .jar f...

jdk -- jar directory traversal vulnerability

Pluf has discovered a vulnerability in Sun Java JDK/SDK, which potentially can be exploited by malicious people to compromise a user's system. The jar tool does not check properly if the files to be extracted have the string "../" on its names, so it's possible for an attacker to create a malicio...

CVE-2002-1308

Heap-based buffer overflow in Netscape and Mozilla allows remote attackers to execute arbitrary code via a jar: URL that references a malformed .jar file, which overflows a buffer during decompression...

CVE-2002-1308

CVE-2002-1308 describes a heap-based buffer overflow in Netscape and Mozilla that can be triggered by a jar: URL referencing a malformed .jar file, causing arbitrary code execution during decompression. The vulnerability affects Mozilla/Netscape components as described in the CVE record and corro...