CVE-2012-6502: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files, and read certain data from files, via a UNC share pathname in the SRC attribute of a SCRIPT element, as demonstrated by reading a name-value pair from a local file via a...

CVE-2012-5931

Directory traversal vulnerability in the setlogconfig function in regclnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote authenticated users to create or overwrite arbitrary files via directory traversal sequences in a log pathname...

Directory traversal

Directory traversal vulnerability in the setlogconfig function in regclnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote authenticated users to create or overwrite arbitrary files via directory traversal sequences in a log pathname...

CVE-2012-1712: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Liferay component in Oracle Sun GlassFish Web Space Server before 10.0 Update 7 Patch 2 has unknown impact and attack vectors...

CVE-2012-4957

Absolute path traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a /FSF/CMD request with a full pathname in a PATH element of an SRS record...

rdesktop: Directory Traversal

Background rdesktop is a Remote Desktop Protocol RDP Client. Description A vulnerability has been discovered in rdesktop. Please review the CVE identifier referenced below for details. Impact Remote RDP servers may be able to read or overwrite arbitrary files via a .. dot dot in a pathname...

Directory traversal

Directory traversal vulnerability in the UTLFILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows remote authenticated users to modify, delete, or read arbitrary files via a pathname in the file field...

CVE-2012-2982: Undefined Security Weakness

file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | pipe character...

Path traversal

Absolute path traversal vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 allows remote administrators to read arbitrary files via a full pathname in the dir parameter in a contents/Files action...

CVE-2011-2657

Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration Management ZCM 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary commands via a pathname in the firs...

CVE-2012-0265

Stack-based buffer overflow in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted pathname for a file...

Stack overflow

Stack-based buffer overflow in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted pathname for a file...

CVE-2012-0265

Stack-based buffer overflow in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted pathname for a file...

PT-2012-2447

Name of the Vulnerable Software and Affected Versions Apple QuickTime versions prior to 7.7.2 Description The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted pathname for a file. Recommendations For Apple QuickTime versions prior to 7.7.2, update...

Design/Logic Flaw

Intuit QuickBooks 2009 through 2012 might allow remote attackers to obtain pathname information via the qbwc://docontrol/GetCompanyFile functionality...

CVE-2012-2423

The intu-help-qb aka Intuit Help System Async Pluggable Protocol handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, provide different responses to remote requests depending on whether a ZIP pathname is valid, which allows remote...

CVE-2012-2422

CVE-2012-2422 affects QuickBooks 2009–2012. The vulnerability arises when using the qbwc://docontrol/GetCompanyFile functionality, which may allow remote attackers to obtain pathname information. The provided documents describe the vulnerability as an information disclosure risk but do not specif...

PT-2012-4033

Name of the Vulnerable Software and Affected Versions Intuit QuickBooks versions 2009 through 2012 Description The issue allows remote attackers to obtain pathname information. This is achieved via the "qbwc://docontrol/GetCompanyFile" functionality. Recommendations For versions 2009 through 2012...

CVE-2012-2422: Exposure of Sensitive Information to an Unauthorized Actor

Intuit QuickBooks 2009 through 2012 might allow remote attackers to obtain pathname information via the qbwc://docontrol/GetCompanyFile functionality...

PHP空字符安全限制绕过漏洞(CVE-2006-7243)

BUGTRAQ ID: 44951 CVE ID: CVE-2006-7243 PHP是一种HTML内嵌式的语言，PHP与微软的ASP颇有几分相似，都是一种在服务器端执行的嵌入HTML文档的脚本语言，语言的风格有类似于C语言，现在被很多的网站编程人员广泛的运用。 PHP 5.3.4之前版本路径名中接受\0字符，通过在此字符后放置安全的文件扩展名，攻击者可绕过目标访问限制。 0 PHP 5.3.x 厂商补丁： PHP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.php.net...