CVE-2005-0287

CVE-2005-0287 affects Bottomline Webseries Payment Application. A remote attacker can read arbitrary files on the network by supplying a modified ReportPath or ReportName in a report template, implying a path-leaking/authorization bypass in report handling. The provided metrics indicate partial c...

CVE-2005-0335

Directory traversal vulnerability in EMotion MediaPartner Web Server 5.0 allows remote attackers to read arbitrary files via a .. dot dot in the URL...

CVE-2005-0202

Directory traversal vulnerability in the truepath function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences...

CVE-2005-0192

Directory traversal vulnerability in the parsing of Skin file names in RealPlayer 10.5 6.0.12.1040 and earlier allows remote attackers to read arbitrary files via a .. dot dot in an RJS filename...

CVE-2005-0072

zhcon before 0.2 does not drop privileges before reading a user configuration file, which allows local users to read arbitrary files...

Minis minis.php month Parameter Traversal Arbitrary File Access

The remote host is running Minis, a weblogging system written in PHP. The remote version of this software is vulnerable to a directory traversal attack. Input to the 'month' parameter of the 'minis.php' script is not properly sanitized. A remote attacker could exploit this to read arbitrary files...

MinisTraverse.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Title: Minis directory traversal vulnerability Vulnerability discovery: Madelman Date: 31/12/2004 Severity: Moderate Summary: - -------- from vendor site: http://minis.sourceforge.net/ Minis is a tiny, PHP-powered, text-file based weblogging system. I...

CVE-2004-1148

phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sqllocalfile parameter...

CVE-2004-1221

Directory traversal vulnerability in weblibs.pl in WebLibs 1.0 allows remote attackers to read arbitrary files via .. sequences in the TextFile parameter...

CVE-2004-1148

phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sqllocalfile parameter...

CVE-2004-1231

Directory traversal vulnerability in Gadu-Gadu allows remote attackers to read arbitrary files via .. dot dot sequences in a DCC connection with a CTCP packet that contains a 1 as the type and a 4 as the subtype...

CVE-2004-2594

Absolute path traversal vulnerability in Quake II server before R1Q2 on Windows, as used in multiple products, allows remote attackers to read arbitrary files via a "/" in a pathname argument, as demonstrated by "download /server.cfg"...

CVE-2004-2105

The webacc servlet in Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to read arbitrary .htt files via a full pathname in the error parameter...

CVE-2004-2617

Directory traversal vulnerability in Pegasi Web Server PWS 0.2.2 allows remote attackers to read files outside of the web root via a .. dot dot directly after the initial '/' slash in the URI...

CVE-2004-2256

Directory traversal vulnerability in phpMyFAQ 1.4.0 alpha allows remote attackers to read arbitrary files, and possibly execute local PHP files, via .. sequences in the lang language variable...

CVE-2004-2640

Directory traversal vulnerability in lstat.cgi in LinuxStat before 2.3.1 allows remote attackers to read arbitrary files via 1 .. dot dot sequences or 2 absolute paths to the template parameter...

CVE-2004-1869

Etherlords I 1.07 and earlier and Etherlords II 1.03 and earlier allows remote attackers to cause a denial of service crash by sending a packet that specifies the size for the next packet, then sending a larger packet than specified, which causes Etherlords to read unallocated memory...

CVE-2004-2333

Bodington 2.1.0 RC1 and earlier does not secure the file upload area, which allows remote attackers to read uploaded files...

CVE-2004-2749

Directory traversal vulnerability in wra/public/wralogin in 2Wire Gateway, possibly as used in HomePortal and other product lines, allows remote attackers to read arbitrary files via a .. dot dot in the return parameter. NOTE: this issue was reported as XSS, but this might be a terminology error...

CVE-2004-2478

Unspecified vulnerability in Jetty HTTP Server, as used in 1 IBM Trading Partner Interchange before 4.2.4, 2 CA Unicenter Web Services Distributed Management WSDM before 3.11, and possibly other products, allows remote attackers to read arbitrary files via a .. dot dot in the URL...