PT-2013-4529

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.5.3 Description The issue allows remote authenticated administrators to execute arbitrary programs. This can be achieved by configuring the aspell pathname and then triggering a spell-check operation within the TinyM...

CVE-2013-6127

The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict ReplaceDBFile method calls, which allows remote attackers to create or overwrite arbitrary files, and subsequently execute arbitrary programs, via the...

Directory traversal

Directory traversal vulnerability in the CLI parser in Cisco NX-OS allows local users to create arbitrary script files via a relative pathname in the "file name" parameter, aka Bug IDs CSCua71557 and CSCua71551...

CVE-2012-4141

Directory traversal vulnerability in the CLI parser in Cisco NX-OS allows local users to create arbitrary script files via a relative pathname in the "file name" parameter, aka Bug IDs CSCua71557 and CSCua71551...

Path traversal

Absolute path traversal vulnerability in the image-download process in the fabric-interconnect component in Cisco Unified Computing System UCS allows local users to overwrite or delete arbitrary files via a full pathname in an image header, aka Bug ID CSCtq02706...

Improper access control

The signature-update functionality in Windows Defender on Microsoft Windows 7 and Windows Server 2008 R2 relies on an incorrect pathname, which allows local users to gain privileges via a Trojan horse application in the %SYSTEMDRIVE% top-level directory, aka "Microsoft Windows 7 Defender Improper...

CVE-2013-3154

The signature-update functionality in Windows Defender on Microsoft Windows 7 and Windows Server 2008 R2 relies on an incorrect pathname, which allows local users to gain privileges via a Trojan horse application in the %SYSTEMDRIVE% top-level directory, aka "Microsoft Windows 7 Defender Improper...

CVE-2013-3154

CVE-2013-3154 affects Windows Defender on Windows 7 and Windows Server 2008 R2. The issue is caused by an incorrect pathname used by the signature-update functionality, enabling local users to gain privileges via a Trojan horse in the %SYSTEMDRIVE% top-level directory. A successful exploit allows...

PT-2013-4184

Name of the Vulnerable Software and Affected Versions Windows Defender on Microsoft Windows 7 and Windows Server 2008 R2 Description The issue concerns the signature-update functionality in Windows Defender, which relies on an incorrect pathname. This allows local users to gain privileges via a...

CVE-2013-4097: Improper Limitation of a Pathname to a Restricted Directory

ServerAdmin/TestDRConnection.jsp in DS3 Authentication Server allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in a -REG-E-OPEN error message...

CVE-2013-3574

Absolute path traversal vulnerability in hpdiags/frontend2/commands/saveCompareConfig.php in HP Insight Diagnostics 9.4.0.4710 allows remote attackers to write data to arbitrary files via a full pathname in the argument to the devicePath aka mount parameter...

CVE-2013-1671

Mozilla Firefox before 21.0 does not properly implement the INPUT element, which allows remote attackers to obtain the full pathname via a crafted web site...

Input validation

Mozilla Firefox before 21.0 does not properly implement the INPUT element, which allows remote attackers to obtain the full pathname via a crafted web site...

CVE-2013-1671

CVE-2013-1671 affects Mozilla Firefox prior to 21.0. The vulnerability arises in the handling of the INPUT/file input element, allowing a remote site to obtain the full local path of a file chosen via the element. This can lead to partial confidentiality impact as described in MFSA 2013-43. The i...

CVE-2013-1671

Mozilla Firefox before 21.0 does not properly implement the INPUT element, which allows remote attackers to obtain the full pathname via a crafted web site...

PT-2013-3306

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 21.0 Description The issue is related to the improper implementation of the INPUT element in Mozilla Firefox, allowing remote attackers to obtain the full pathname via a crafted web site. Recommendations For...

CVE-2013-1671: Improper Input Validation

Mozilla Firefox before 21.0 does not properly implement the INPUT element, which allows remote attackers to obtain the full pathname via a crafted web site...

CVE-2013-1671

Mozilla Firefox before 21.0 does not properly implement the INPUT element, which allows remote attackers to obtain the full pathname via a crafted web site...

CVE-2013-0726

Stack-based buffer overflow in the ERMconverttocorrectwebpath function in ermapperu.dll in ERDAS ER Viewer before 13.00.0001 allows remote attackers to execute arbitrary code via a crafted pathname in an ERS file...

PT-2013-2562

Name of the Vulnerable Software and Affected Versions ERDAS ER Viewer versions prior to 13.00.0001 Description The issue is related to a stack-based buffer overflow in the ERM convert to correct webpath function, located in the ermapper u.dll file. This allows remote attackers to execute arbitrar...