[UNIX] AHG EZshopper loadpage.cgi Directory Traversal (.|./ Attack)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

PT-2004-2059 · Apache +1 · Apache +1

Name of the Vulnerable Software and Affected Versions: Apache for Apple Mac OS X versions 10.2.8 and 10.3.6 Description: The issue arises from the difference in how Apache and the Apple HFS+ filesystem handle file access in terms of case sensitivity. Apache restricts access to files in a...

pntresmailer 6.0 - Directory Traversal

source: https://www.securityfocus.com/bid/11767/info pnTresMailer is reported susceptible to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input data. This vulnerability can be exploited to retrieve arbitrary, potentially...

EZshopper Directory Transversal in loadpage.cgi

No description provided by source. Example: http://targethost/cgi-bin/loadpage.cgi?userid=id&file=.|./.|./.|./.|./.|./etc/passwd%00.html milw0rm.com 2004-11-25...

cPanel 9.9.1 -R3 Front Page Extension - Installation Information Disclosure

source: https://www.securityfocus.com/bid/11456/info It is reported that cPanel is susceptible to an information disclosure vulnerability in its function to enable Front Page extensions. This vulnerability reportedly allows attackers to gain access to the contents of arbitrary, potentially...

samba -- remote file disclosure

According to a Samba Team security notice: A security vulnerability has been located in Samba 2.2.x = 2.2.11 and Samba 3.0.x = 3.0.5. A remote attacker may be able to gain access to files which exist outside of the share's defined path. Such files must still be readable by the account used for th...

myserver 0.7 - Directory Traversal

myserver 0.7 - Directory Traversal source: https://www.securityfocus.com/bid/11189/info MyServer is reported prone to a remote directory traversal vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data. This vulnerability results in improper access to...

myserver 0.7 - Directory Traversal

source: https://www.securityfocus.com/bid/11189/info MyServer is reported prone to a remote directory traversal vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data. This vulnerability results in improper access to potentially sensitive files located...

Turbo Seek Null Byte Error Discloses Files to Remote Users

Exploit for cgi platform in category web applications ========================================================== Turbo Seek Null Byte Error Discloses Files to Remote Users ========================================================== Some demonstration exploit URLs are provided:...

Turbo Seek Null Byte Error Discloses Files to Remote Users

No description provided by source. Some demonstration exploit URLs are provided: /cgi-bin/cgi/tseekdir.cgi?location=/etc/passwd%00 /cgi-bin /tseekdir.cgi?id=799&location=/etc/passwd%00 milw0rm.com 2004-09-13...

[UNIX] WebAPP Directory Traversal and Encrypted DES Disclosure

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

Debian bsdmainutils 6.0.14 - Calendar Information Disclosure

Debian bsdmainutils 6.0.14 - Calendar Information Disclosure // source: https://www.securityfocus.com/bid/11077/info The calendar utility contained in the bsdmainutils package on Debian GNU/Linux systems is reported susceptible to an information disclosure vulnerability. This is due to a lack of...

Bugs fixed in Version 1.4.3

In-Reply-To: [email protected] B. Unspecified File Download Vulnerability B1. An error in the MyDMS software allows to a registered users and only to registered users to download any file, such as /etc/passwd, by inserting in a parameter a text such as...

Web-APP.Org WebAPP 0.8/0.9.x - Directory Traversal

source: https://www.securityfocus.com/bid/11028/info WebAPP is reported prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input data. An attacker can exploit this vulnerability to retrieve arbitrary, potentially sensitive files from the...

IBM Tivoli Directory Server 3.2.2/4.1 - LDACGI Directory Traversal

source: https://www.securityfocus.com/bid/10841/info IBM Tivoli Directory Server is reported to contain a directory traversal vulnerability in its web front-end application. This issue presents itself due to insufficient sanitization of user-supplied data. This issue allows remote attackers to vi...

IBM Tivoli Directory Server 3.2.24.1 - LDACGI Directory Traversal

IBM Tivoli Directory Server 3.2.24.1 - LDACGI Directory Traversal source: https://www.securityfocus.com/bid/10841/info IBM Tivoli Directory Server is reported to contain a directory traversal vulnerability in its web front-end application. This issue presents itself due to insufficient sanitizati...

CVE-2004-0613

osTicket

[Full-Disclosure] Security hole in Confixx backup script

Hi, I found a security hole in Confixx. A malicious backup request via the webinterface might be used by any user to read files located in /root which is the default installation directory of confixx. The most interesting files you can retrieve with this attack are: /root/confixx/safe/shadow.tmp...

Linksys Web Camera Software 2.10 - Next_file File Disclosure

Linksys Web Camera Software 2.10 - Nextfile File Disclosure source: https://www.securityfocus.com/bid/10476/info It is reported that Linksys Web Camera software is prone to a remote file disclosure vulnerability that may allow a remote attacker to disclose sensitive files. Linksys Web Camera...

Linksys Web Camera Software 2.10 - 'Next_file' File Disclosure

source: https://www.securityfocus.com/bid/10476/info It is reported that Linksys Web Camera software is prone to a remote file disclosure vulnerability that may allow a remote attacker to disclose sensitive files. Linksys Web Camera software version 2.10 is reportedly prone to this issue, however...