CVE-2009-0442

CVE-2009-0442 affects PHPbbBook 1.3 and 1.3h. The vulnerability is a directory traversal in bbcode.php via the l parameter, allowing an attacker to include and execute arbitrary local files by supplying a ".." path component. Root cause is improper validation of the l parameter leading to path tr...

NPDS 08.06 - Multiple Input Validation Vulnerabilities

NPDS 08.06 - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/33051/info NPDS is prone to multiple input-validation vulnerabilities: - Multiple local file-include vulnerabilities - An HTML-injection vulnerability - Multiple SQL-injection vulnerabilities - Multip...

file: URIs inherit chrome privileges

Mozilla Firefox 3.x before 3.0.4 assigns chrome privileges to a file: URI when it is accessed in the same tab from a chrome or privileged about: page, which makes it easier for user-assisted attackers to execute arbitrary JavaScript with chrome privileges via malicious code in a file that has...

Directory traversal

Directory traversal vulnerability in list.php in 1Scripts CodeDB 1.1.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2008-2782

Multiple directory traversal vulnerabilities in OtomiGenX 2.2 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter to 1 libraryrss.php and 2 rss.php...

Microsoft Windows Vista - Windows Mail Local File Execution

source: https://www.securityfocus.com/bid/23103/info Microsoft Windows Vista Windows Mail is prone to a local file-execution vulnerability due to a design error. An attackers may exploit this issue to execute local files. The attacker must entice a victim into opening a maliciously crafted link...

Microsoft Windows Vista - Windows Mail Local File Execution

Microsoft Windows Vista - Windows Mail Local File Execution source: https://www.securityfocus.com/bid/23103/info Microsoft Windows Vista Windows Mail is prone to a local file-execution vulnerability due to a design error. An attackers may exploit this issue to execute local files. The attacker mu...

CVE-2006-5658

BlooMooWeb ActiveX control AidemATL.dll allows remote attackers to 1 download arbitrary files via a URL in the bstrUrl parameter to the BWDownloadFile method, 2 execute arbitrary local files via a file path in the bstrParams parameter to the BWLaunchGame method, and 3 delete arbitrary files via a...

AOL Instant Messenger URL href Attribute Traversal Arbitrary Local File Execution

Binary data 1245.prm...

firstclass71.txt

Product: FirstClass Desktop Client 7.1 Developer: SoftArc URL: http://www.softarc.com/ Description: Users clicking on a maliciously crafted link will result in local file execution. Details: FirstClass RTF formatted messages can include hyper-links to web URL's. When the messages recipient clicks...

Microsoft Internet Explorer 5/6 - 'file://' Request Zone Bypass

source: https://www.securityfocus.com/bid/7539/info Internet Explorer is reported to be vulnerable to a zone bypass issue. Allegedly, if Internet Explorer attempts to open a web page containing numerous 'file://' requests each contained in a separate Iframe, the requested file will eventually be...

AOL Instant Messenger 4.8.2790 - Local File Execution

source: https://www.securityfocus.com/bid/6027/info AOL Instant Messenger AIM is prone to an issue which may allow attackers to execute arbitrary files on the client system. It is possible to send a malicious link which references local files to a user of the client. When the link is visited, the...

AOL Instant Messenger 4.8.2790 - Local File Execution

AOL Instant Messenger 4.8.2790 - Local File Execution source: https://www.securityfocus.com/bid/6027/info AOL Instant Messenger AIM is prone to an issue which may allow attackers to execute arbitrary files on the client system. It is possible to send a malicious link which references local files ...

Очередная уязвимость в Internet Explorer / Outlook

С помощью meta http-equiv="refresh" можно принудительно загрузить приаттаченный файл с установками локальной зоны безопасности, что позволяет выполнять приложения без подтверждения пользователем. Кроме того, можно выполнить любой локальный файл используя несуществующий элемент ActiveX: OBJECT...