contentserv 4.x

ContentServ again still features remote reading of arbitrary files ==================================================================== ContentServ is a cms and "cross media publishing" software. Let me quote from their website: "At ContentServ, there is always something happening. We continously...

ContentServ 4.x - '/admin/FileServer.php' File Disclosure

ContentServ again still features remote reading of arbitrary files ==================================================================== ContentServ is a cms and "cross media publishing" software. Let me quote from their website: "At ContentServ, there is always something happening. We continously...

CVE-2006-6084

CVE-2006-6084 is a directory traversal in abitwhizzy.php of aBitWhizzy that lets remote attackers read arbitrary files via a .. in the f parameter. The PTSecurity entry reiterates the vulnerability and notes affected software without specifying fixed versions, and the NVD entry provides the same ...

EUVD-2006-5757

Directory traversal vulnerability in index.php in FreeWebshop 2.2.1 and earlier allows remote attackers to read arbitrary files and disclose the installation path via a .. dot dot in the action parameter...

security flaw

The copyfromuser function in the uaccess code in Linux kernel 2.6 before 2.6.19-rc1, when running on s390, does not properly clear a kernel buffer, which allows local user space programs to read portions of kernel memory by "appending to a file from a bad address," which triggers a fault that...

CVE-2006-5393

Cisco Secure Desktop CSD does not require that the ClearPageFileAtShutdown aka CCE-Winv2.0-407 registry value equals 1, which might allow local users to read certain memory pages that were written during another user's SSL VPN session...

CVE-2006-5319

Foafgen 0.3 is affected by a directory traversal in redir.php that allows a remote attacker to read arbitrary files using a .. segment in the foaf parameter. The vulnerability is triggered by supplying a traversing path via the foaf parameter, enabling access to filesystem content. Exploitation d...

CVE-2006-5218

The CVE-2006-5218 entry describes an integer overflow in the systrace_preprepl function (STRIOCREPLACE) within the systrace component of OpenBSD 3.9 and NetBSD 3. This vulnerability can be triggered by large numeric arguments to the systrace ioctl, allowing local users to cause a denial of servic...

CVE-2006-5205

Vulnerability CVE-2006-5205 affects Invision Gallery 2.0.7. A directory traversal flaw allows remote attackers to read arbitrary files via a .. sequence in the dir parameter when using the viewimage command in the gallery module (index.php and forum/index.php). Public exploit references exist (Ex...

CVE-2006-4914

CVE-2006-4914 describes a directory traversal vulnerability in A.l-Pifou 1.8p2. An attacker can read arbitrary files by manipulating the ze_langue_02 cookie via the choix_lng parameter to choix_langue.php, which indirectly sets the cookie and allows triggering an inclusion from inc/change_lang_ck...

PYSEC-2006-8

The docutils module in Zope Zope2 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText reST markup, which allows remote attackers to read arbitrary files via a csvtable directive, a different vulnerability than CVE-2006-3458...

CVE-2006-4615

The CVE documents a vulnerability in Shape Services IM+ Mobile Instant Messenger for Pocket PC, version 3.10, where usernames and passwords are stored in plaintext in %PROGRAMFILES%\IMPlus\implus.cfg. This local-access issue allows a user with file-read privileges to obtain credentials. Affected ...

CVE-2006-4353

The CVE concerns Sun Java System Content Delivery Server versions 4.0, 4.1 and 5.0. Affected component: Content Delivery Server; vulnerability type described as an unspecified flaw that allows local and remote attackers to read data from arbitrary files via unspecified vectors. The exact root cau...

SquirrelMail compose.php session_expired_post Arbitrary Variable Overwriting

The installed version of SquirrelMail allows for restoring expired sessions in an unsafe manner. Using a specially crafted expired session and compose.php, a user can leverage this issue to take control of arbitrary variables used by the affected application, which can lead to other attacks again...

CVE-2006-4006

The dogameinfo function in BomberClone 0.11.6 and earlier, and possibly other functions, does not reset the packet data size, which causes the sendpkg function packets.c to use this data size when sending a reply, and allows remote attackers to read portions of server memory...

CVE-2006-4006

The CVE-2006-4006 issue affects BomberClone, specifically version 0.11.6 and earlier. The root cause is in do_gameinfo, which fails to reset the packet data size, causing send_pkg (packets.c) to use an incorrect data size when replying. This behavior can allow remote attackers to read portions of...

CVE-2006-3921

Summary (CVE-2006-3921): Affects Sun Java System Application Server (SJSAS) 7–8.1 and Web Server (SJSWS) 6.0–6.1. The issue permits remote authenticated users to read files outside the “document root” via a direct request using a UTF-8 encoded URI. The NVD entry lists a Medium base score (AV:N/AC...

FreeBSD : shoutcast -- XSS, information exposure (67dbe99f-0f09-11db-94f8-00e029485e38)

Goober's advisory reports reports that shoutcast is vulnerable to an arbitrary file reading vulnerability : Impact of the vulnerability depends on the way the product was installed. In general, the vulnerability allows the attacker to read any file which can be read by the Shoutcast server proces...

CVE-2006-3392

Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename...

IE_ONE_MINOR_ONE_MAJOR

REPORT NAME: PLEBO-2006.06.16-IEONEMINORONEMAJOR DESTINATION: To Publish EMAIL RECPT: bugtraq CONTENTS 0. IMPORTANT NOTICE 1. SUMMARY 2. READ CONTENT OF ANY DOMAIN - PROOF OF CONCEPT 3. READ CONTENT OF ANY DOMAIN - TIPS FOR MATURE EXPLOIT 4. DOUBLE-CLICK ANYWHERE ON WEB PAGE COULD ALLOW REMOTE CO...