CVE-2009-2701

The CVE-2009-2701 issue affects Zope Object Database (ZODB) with ZEO storage-server sharing and blob support enabled, specifically ZODB versions prior to 3.8.3 (3.8.x) and prior to 3.9.0c2 (3.9.x). The vulnerability allows remote authenticated users to read or delete arbitrary files via unknown v...

CVE-2009-2944

Incomplete blacklist vulnerability in the teximg plugin in ikiwiki before 3.1415926 and 2.x before 2.53.4 allows context-dependent attackers to read arbitrary files via crafted TeX commands...

CVE-2009-2935

Google V8, as used in Google Chrome before 2.0.172.43, allows remote attackers to bypass intended restrictions on reading memory, and possibly obtain sensitive information or execute arbitrary code in the Chrome sandbox, via crafted JavaScript...

Design/Logic Flaw

Google V8, as used in Google Chrome before 2.0.172.43, allows remote attackers to bypass intended restrictions on reading memory, and possibly obtain sensitive information or execute arbitrary code in the Chrome sandbox, via crafted JavaScript...

CVE-2009-2935

Google Chrome

CVE-2009-2935

Removed by vendor...

openSUSE Security Update : NetworkManager-gnome (NetworkManager-gnome-563)

The NetworkManager configuration was too permissive and allowed any user to read secrets CVE-2009-0365 or manipulate the configuration of other users CVE-2009-0578. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

openSUSE Security Update : seamonkey (seamonkey-238)

This patch updates SeaMonkey to version 1.1.12, fixing security and other bugs : MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before...

DEBIAN-CVE-2009-2334

wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as...

CVE-2009-2325

CVE-2009-2325 affects Clicknet CMS 2.1, via a directory traversal in index.php: an attacker can read arbitrary files by supplying .. in the side parameter. The NVD entry confirms the vulnerability with a CVSS v2 base score of 5.0 (Medium) and network access with no authentication. Several connect...

CVE-2009-2184

Absolute path traversal vulnerability in forcedownload.php in Gravy Media Photo Host 1.0.8 allows remote attackers to read arbitrary files via an encoded "/" slash in the file parameter...

CVE-2009-2166

Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to read arbitrary files via a full pathname in the log parameter...

CVE-2004-2764

Sun SDK and Java Runtime Environment JRE 1.4.2 through 1.4.204, 1.4.1 through 1.4.107, and 1.4.0 through 1.4.004 allows untrusted applets and unprivileged servlets to gain privileges and read data from other applets via unspecified vectors related to classes in the XSLT processor, aka "XML...

perl-DBD-Pg: pg_getline buffer overflow

Heap-based buffer overflow in the DBD::Pg aka DBD-Pg or libdbd-pg-perl module 1.49 for Perl might allow context-dependent attackers to execute arbitrary code via unspecified input to an application that uses the getline and pggetline functions to read database rows...

KLA10210 Vulnerability in IBM Tivoli Storage Manager

An unspecified vulnerability was found in IBM Tivoli Storage Manager. By exploiting this vulnerability malicious users can conduct a man-in-the-middle attack and read arbitrary files. This vulnerability can be exploited remotely at a point related to SSL. Original advisories - Related products...

DEBIAN-CVE-2009-0663

Heap-based buffer overflow in the DBD::Pg aka DBD-Pg or libdbd-pg-perl module 1.49 for Perl might allow context-dependent attackers to execute arbitrary code via unspecified input to an application that uses the getline and pggetline functions to read database rows...

AIX 5.3 TL 6 : bos.rte.cron (U821986)

The remote host is missing AIX PTF U821986, which is related to the security of the package bos.rte.cron. The at command does not drop permissions when reading certain files. A local attacker may exploit this error to read any file on the system because the command is setuid root. The following...

CVE-2009-1368

Directory traversal vulnerability in index.php in moziloCMS 1.11 allows remote attackers to read arbitrary files via a .. dot dot in the page parameter. NOTE: this might be the same issue as CVE-2008-6126.2, which may have been fixed in 1.10.3...

CVE-2009-1368

CVE-2009-1368 describes a directory traversal vulnerability in moziloCMS 1.11 where an attacker can read arbitrary files by injecting a deroute “..” into the page parameter of index.php. Related entries indicate a similar issue in moziloCMS 1.10.2 and earlier (CVE-2008-6126) with the same dot-dot...

CVE-2009-0582

The ntlmchallenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server aka evolution-data-server 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount o...