goserv is an http server. goserv is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


intsol-package is a file server. intsol-package is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


Directory traversal vulnerability in the \Upload Groupkey\ functionality in the Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with Admin-User access to write to arbitrary files and consequently gain root privileges by uploading a file as demonstrated by storing a file in the cron.d directory.


zwserver is a weather web server. zwserver is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


jn_jj_server is a static file server. jn_jj_server is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


fast-http-cli is the command line interface for fast-http a simple web server. fast-http-cli is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulnerability in hostr 2.3.5 and earlier that allows an attacker to read files outside the current directory by sending `../` in the url path for GET requests.


dmmcquay.lab6 is a REST server. dmmcquay.lab6 is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


susu-sum is a static file server. susu-sum is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


lab6drewfusbyu is an http server. lab6drewfusbyu is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


sspa is a server dedicated to single-page apps. sspa is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the URL.


uv-tj-demo is a static file server. uv-tj-demo is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


whispercast is a file server. whispercast is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


dgard8.lab6 is a static file server. dgard8.lab6 is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


uekw1511server is a static file server. uekw1511server is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


ritp is a static web server. ritp is vulnerable to a directory traversal issue whereby an attacker can gain access to the file system by placing ../ in the URL. Access is restricted to files with a file extension so files such as /etc/passwd are not accessible.


lab6.brit95 is a file server. lab6.brit95 is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


myserver.alexcthomas18 is a file server. myserver.alexcthomas18 is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


ewgaddis.lab6 is a file server. ewgaddis.lab6 is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


`f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url. This is compounded by `f2e-server` requiring elevated privileges to run.


The

Process

function

in

in

Ulterius

before

allows

HTTP

server

directory

traversal.


The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated directory traversal vulnerability exploited by issuing a specially crafted request allowing a remote attacker to read/write arbitrary files. This can be exploited via ../ sequences in the pathname to miner_file or miner_getfile.


scott-blanch-weather-app is a sample Node.js app using Express 4. scott-blanch-weather-app is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


reecerver is a web server. reecerver is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


dasafio is a web server. dasafio is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url. File access is restricted to only .html files.


simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


earlybird is a web server module for early development. earlybird is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


calmquist.static-server is a static file server. calmquist.static-server is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


wind-mvc is an mvc framework. wind-mvc is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


picard is a micro framework. picard is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


utahcityfinder constructs lists of Utah cities with a certain prefix. utahcityfinder is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


list-n-stream is a server for static files to list and stream local videos. list-n-stream v0.0.10 or lower is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


infraserver is a RESTful server. infraserver is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


easyquick is a simple web server. easyquick is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url. Access is constrained however to supported file types. Requesting a file such as /etc/passwd returns a \not supported\ error.


mockserve is a file server. mockserve is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


chatbyvista is a file server. chatbyvista is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


360class.jansenhm is a static file server. 360class.jansenhm is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


static-html-server is a static file server. static-html-server is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


fbr-client sends files through sockets via socket.io and webRTC. fbr-client is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


iter-http is a server for static files. iter-http is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


exxxxxxxxxxx is an Http eX Frame Google Style JavaScript Guide. exxxxxxxxxxx is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url. Accessible files are restricted to those with a file extension. Files with no extension such as /etc/passwd throw an error.


Sanic before 0.5.1 allows reading arbitrary files with directory traversal as demonstrated by the /static/..%2f substring.


getcityapi.yoehoehne is a web server. getcityapi.yoehoehne is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


fsk-server is a simple http server. fsk-server is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


elding is a simple web server. elding is vulnerable to a directory traversal issue allowing an attacker to access the filesystem by placing \../\ in the url. The files accessible however are limited to files with a file extension. Sending a GET request to /../../../etc/passwd for example will return a 404 on etc/passwd/index.js.


http_static_simple is an http server. http_static_simple is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


A Directory Traversal issue was discovered in the Foxit MobilePDF app before 6.1 for iOS. This occurs by abusing the URL + escape character during a Wi-Fi transfer which could be exploited by attackers to bypass intended restrictions on local application files.


An issue was discovered in Symfony before 2.7.38 2.8.31 3.2.14 3.3.13 3.4-BETA5 and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read() methods of these classes use a path and a locale to determine the language bundle to retrieve. The locale argument value is commonly retrieved from untrusted user input (like a URL parameter). An attacker can use this argument to navigate to arbitrary directories via the dot-dot-slash attack aka Directory Traversal.


`gomeplus-h5-proxy` is vulnerable to a directory traversal issue allowing attackers to access any file in the system by placing '../' in the URL.


tencent-server is a simple web server. tencent-server is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


unicorn-list is a web framework. unicorn-list is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


censorify.tanisjr is a simple web server and API RESTful service. censorify.tanisjr is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace allowing attackers to obtain sensitive information.


xtalk helps your browser talk to nodex a simple web framework. xtalk is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the URL.


byucslabsix is an http server. byucslabsix is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


citypredict.whauwiller is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


section2.madisonjbrooks12 is a simple web server. section2.madisonjbrooks12 is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


jikes is a file server. jikes is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url. Accessible files are restricted to files with .htm and .js extensions.


Directory Traversal vulnerability in app_data_center on Shenzhen Tenda Ac9 US_AC9V1.0BR_V15.03.05.14_multi_TD01 Ac9 ac9_kf_V15.03.05.19(6318_)_cn Ac15 US_AC15V1.0BR_V15.03.05.18_multi_TD01 Ac15 US_AC15V1.0BR_V15.03.05.19_multi_TD01 Ac18 US_AC18V1.0BR_V15.03.05.05_multi_TD01 and Ac18 ac18_kf_V15.03.05.19(6318_)_cn devices allows remote unauthenticated attackers to read arbitrary files via a cgi-bin/luci/request?op=1&path= URI that uses directory traversal sequences after a /usb/ substring.


tinyserver2 is a webserver for static files. tinyserver2 is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the URL.


gaoxiaotingtingting is an HTTP server. gaoxiaotingtingting is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


commentapp.stetsonwood is an http server. commentapp.stetsonwood is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


iter-server is a static file server. iter-server is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


weather.swlyons is a simple web server for weather updates. weather.swlyons is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


shit-server is a file server. shit-server is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter in conjunction with PHP code in the content parameter within a template Style add request to index.php.


jansenstuffpleasework is a file server. jansenstuffpleasework is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


open-device creates a web interface for any device. open-device is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js a multi-session manager. rtcmulticonnection-client is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download() function. By using a specially-crafted build of Meterpreter it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.


The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files an attacker can upload a malicious file that uses \../\ pathname substrings to write arbitrary files to the filesystem.


All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi Clipboard.parse_dump() function. By using a specially-crafted build of Meterpreter it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.


All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cmd_download() function. By using a specially-crafted build of Meterpreter it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.


An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior and XLWeb 500 XLWebExe-1-02-08 and prior. A user without authenticating can make a directory traversal attack by accessing a specific URL.


The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\\/ to bypass the filter rule. Then this attacker can exploit this vulnerability to delete or read any files on the server. It can also be used to determine whether a file exists.


Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using \..\ in tar archive entries


Structured Data Linter versions 2.4.1 and older are vulnerable to a directory traversal attack in the URL input field resulting in the possibility of disclosing information about the remote host.


jqueryFileTree 2.1.5 and older Directory Traversal


rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version resulting in arbitrary code execution


Oracle GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability that can be exploited by issuing a specially crafted HTTP GET request.


Seagate Media Server in Seagate Personal Cloud before 4.3.18.4 has directory traversal in getPhotoPlaylistPhotos.psp via a parameter named url.


An issue was discovered in Mattermost Server before 4.3.0 4.2.1 and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.


The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.


Certain

NETGEAR

devices

are

affected

by

directory

traversal.

This

affects

before

before

before

before

before

before

before

before

before

and

before


The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.


CDG

through

allows

downloadDocument.jsp?command=download&pathAndName=

directory

traversal.


An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url \/port_3480\. It seems that the UPnP services provide \file\ as one of the service actions for a normal user to read a file that is stored under the /etc/cmh-lu folder. It retrieves the value from the \parameters\ query string variable and then passes it to an internal function \FileUtils::ReadFileIntoBuffer\ which is a library function that does not perform any sanitization on the value submitted and this allows an attacker to use directory traversal characters \../\ and read files from other folders within the device.


An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a script file called \get_file.sh\ which allows a user to retrieve any file stored in the \cmh-ext\ folder on the device. However the \filename\ parameter is not validated correctly and this allows an attacker to directory traverse outside the /cmh-ext folder and read any file on the device. It is necessary to create the folder \cmh-ext\ on the device which can be executed by an attacker first in an unauthenticated fashion and then execute a directory traversal attack.


A Path Traversal issue was discovered in Schneider Electric Pelco VideoXpert Enterprise all versions prior to 2.1. By sniffing communications an unauthorized person can execute a directory traversal attack resulting in authentication bypass or session hijack.


A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary files or reveal the content of arbitrary files anywhere on the web server by crafting a URL with a manipulated POST request.


In MODX Revolution before 2.5.7 when PHP 5.3.3 is used an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php aka directory traversal.


A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory traversal vulnerability could allow a remote attacker with network access to the integrated web server (80/tcp and 443/tcp) to obtain information on the structure of the file system of the affected devices.


The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows a directory traversal attack that bypasses a uniqid protection mechanism and makes it easier to read arbitrary uploaded files.


Secure Bytes Cisco Configuration Manager as bundled in Secure Bytes Secure Cisco Auditor (SCA) 3.0 has a Directory Traversal issue in its TFTP Server allowing attackers to read arbitrary files via ../ sequences in a pathname.


The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.


An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows the highest privileges a user can obtain on the device. This web interface uses root as the username and the password in the /etc/cmh/cmh.conf file which can be extracted by an attacker using a directory traversal attack and then log in to the device with the highest privileges.


Fiyo

CMS

has

an

arbitrary

file

delete

vulnerability

in

via

directory

traversal

in

the

file

parameter

during

an

act=db

action.


Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information.


In EMC ViPR SRM Storage M&R VNX M&R and M&R (Watch4Net) for SAS Solution Packs the Webservice Gateway is affected by a directory traversal vulnerability. Attackers with knowledge of Webservice Gateway credentials could potentially exploit this vulnerability to access unauthorized information and modify or delete data by supplying specially crafted strings in input parameters of the web service call.


Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.


Debian ftpsync before 20171017 does not use the rsync --safe-links option which allows remote attackers to conduct directory traversal attacks via a crafted upstream mirror.


dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package as demonstrated by use of dpkg-source on NetBSD.


acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to requests submitted through CSRF.


In FlightGear before 2017.2.1 the FGCommand interface allows overwriting any file the user has write access to but not with arbitrary data: only with the contents of a FlightGear flightplan (XML). A resource such as a malicious third-party aircraft could exploit this to damage files belonging to the user. Both this issue and CVE-2016-9956 are directory traversal vulnerabilities in Autopilot/route_mgr.cxx - this one exists because of an incomplete fix for CVE-2016-9956.


Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33 8..0.0.0 before 8.0.0.23 9.0.0.0 before 9.0.0.19 and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx.


Directory traversal vulnerability in the PharData class in PHP before 5.4.44 5.5.x before 5.5.28 and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via a .. (dot dot) in a ZIP archive entry that is mishandled during an extractTo call.


Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPress allow remote attackers to include and execute arbitrary files via the csvfile parameter related to \upload file functionality.\


Directory traversal vulnerability on Huawei HG532e HG532n and HG532s devices allows remote attackers to read arbitrary files via a .. (dot dot) in an icon/ URI.


Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4 when used on systems that do not use '\\' or '/' characters for directory separation such as OpenVMS allows remote authenticated users to overwrite arbitrary files.


Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overwrite or create arbitrary files as the system-level user via a .. (dot dot) in the name of a file compressed into a zipped file named cred.zip and downloaded to /sdcard/Download.


Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt when fine-grained Access Control Lists (ACL) are in effect allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.


Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45 7.x before 7.0.65 and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource getResourceAsStream or getResourcePaths call as demonstrated by the $CATALINA_BASE/webapps directory.


Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.


Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this vulnerability exists due to an incomplete fix to CVE-2015-4180.


Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this vulnerability exists due to an incomplete fix to CVE-2009-4050.


Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to AjaxFileUploadHandler.axd.


Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a load_template action to wp-admin/admin-ajax.php.


Directory traversal vulnerability in EMC RSA OneStep 6.9 before build 559 as used in RSA Certificate Manager and RSA Registration Manager through 6.9 build 558 and other products allows remote attackers to read arbitrary files via a crafted KCSOSC_ERROR_PAGE parameter.


Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16 3.16.x before 3.16.12 3.18.x before 3.18.08 and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path parameter to (1) svc/virtualshelves/search or (2) svc/members/search.


Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) remote authenticated users to read arbitrary files via a .. (dot dot) in the Modifier parameter to PlcmRmWeb/FileDownload; or remote authenticated administrators to upload arbitrary files via the (2) Filename or (3) SE_FNAME parameter to PlcmRmWeb/FileUpload or to read and remove arbitrary files via the (4) filePathName parameter in an importSipUriReservations SOAP request to PlcmRmWeb/JUserManager.


Directory traversal vulnerability in the replay server in IBM Tealeaf Customer Experience before 8.7.1.8818 8.8 before 8.8.0.9026 9.0.0 9.0.0A 9.0.1 before 9.0.1.1083 9.0.1A before 9.0.1.5073 9.0.2 before 9.0.2.1095 and 9.0.2A before 9.0.2.5144 allows remote attackers to read arbitrary files via unspecified vectors.


Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O XL1000C100 104 I/O XL1000C500 300 I/O XL1000C1000 600 I/O XL1000C50U 52 I/O UUKL XL1000C100U 104 I/O UUKL XL1000C500U 300 I/O UUKL and XL1000C1000U 600 I/O UUKL controllers before 2.04.01 allows remote attackers to read files under the web root and consequently obtain administrative login access via a crafted pathname.


Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.


IBM Tivoli IT Asset Management for IT Tivoli Service Request Manager and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and Maximo Industry Solutions 7.1 through 7.1.1.8 7.5 before 7.5.0.7 IFIX003 and 7.6 before 7.6.0.0 IFIX002 allow remote authenticated users to conduct directory traversal attacks via unspecified vectors.


Directory traversal vulnerability in EMC Documentum Thumbnail Server 6.7SP1 before P32 6.7SP2 before P25 7.0 before P19 7.1 before P16 and 7.2 before P01 allows remote attackers to bypass intended Content Server access restrictions via unspecified vectors.


Multiple

directory

traversal

vulnerabilities

in

IceWarp

Mail

Server

before

allow

remote

attackers

to

read

arbitrary

files

via

a

(dot

dot)

in

the

file

parameter

to

a

page

or

(dot

dot

dot

slash

dot)

in

the

script

or

style

parameter

to


Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734.


Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2 8.0.x through 8.0.1.3 8.5.0 through 8.5.0.1 and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted internationalization-file URL.


Directory traversal vulnerability in the Web Administration tool in IBM Tivoli Directory Server (ITDS) before 6.1.0.74-ISS-ISDS-IF0074 6.2.x before 6.2.0.50-ISS-ISDS-IF0050 and 6.3.x before 6.3.0.43-ISS-ISDS-IF0043 and IBM Security Directory Server (ISDS) before 6.3.1.18-ISS-ISDS-IF0018 and 6.4.x before 6.4.0.9-ISS-ISDS-IF0009 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.


Directory

traversal

vulnerability

in

the

Ubuntu

network-manager

package

for

Ubuntu

(vivid)

before

Ubuntu

before

and

Ubuntu

LTS

before

allows

local

users

to

change

the

modem

device

configuration

or

read

arbitrary

files

via

a

(dot

dot)

in

the

file

name

in

a

request

to

read

modem

device

contexts

(com.canonical.NMOfono.ReadImsiContexts).


Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module related to the blockDirective function and the auto loading mechanism. NOTE: vector 2 might not cross privilege boundaries since administrators might already have the privileges to execute code and upload files.


Directory traversal vulnerability in the min_get_slash_argument function in lib/configonlylib.php in Moodle through 2.5.9 2.6.x before 2.6.8 2.7.x before 2.7.5 and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter as demonstrated by reading PHP scripts.


Directory traversal vulnerability in the NC854 and NC856 modules for IDS RTU 850C devices allows remote authenticated users to read arbitrary files via unspecified vectors involving an internal web server as demonstrated by reading a TELNET credentials file.


Directory

traversal

vulnerability

in

TP-LINK

Archer

with

firmware

before

with

firmware

before

and

with

firmware

before

Archer

and

with

firmware

before

and

with

firmware

before

and

and

with

firmware

before

allows

remote

attackers

to

read

arbitrary

files

via

a

(dot

dot)

in

the

to

login/.


Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read write to or change ownership of arbitrary files via unspecified vectors to the (1) NewProblem (2) GetInfo (3) SetElement or (4) DeleteElement method.


Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297.


Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. (dot dot) in the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.


cabextract before 1.6 does not properly check for leading slashes when extracting files which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash.


SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile as demonstrated by a large directory traversal sequence which reveals the installation path in an error message.


PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress when allow_url_include is enabled allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled.


Samsung wssyncmlnps before 2015-10-31 allows directory traversal in a Kies restore aka ZipFury.


Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the element name of the \work\ array parameter to admin/bitrix.mpbuilder_step2.php.


Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5 Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1 Critical System Protection (SCSP) before 5.2.9 MP6 Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1 and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to write update-package data to arbitrary agent locations via unspecified vectors.


The

plugin

for

WordPress

has

directory

traversal

via

the

path

parameter.


The web management interface of Ubiquiti airMAX airFiber airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerability to gain root privileges. This vulnerability is fixed in the following product versions (fixes released in July 2015 all prior versions are affected): airMAX AC 7.1.3; airMAX M (and airRouter) 5.6.2 XM/XW/TI 5.5.11 XM/TI and 5.5.10u2 XW; airGateway 1.1.5; airFiber AF24/AF24HD 2.2.1 AF5x 3.0.2.1 and AF5 2.2.1; airOS 4 XS2/XS5 4.0.4; and EdgeSwitch XP (formerly TOUGHSwitch) 1.3.2.


The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter.


Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field (\kid\) of the IdP's HTTP response message (\WLS-Response\) can be manipulated by an attacker. The \kid\ field is not signed like the rest of the message and manipulation is therefore trivial. The \kid\ field should only ever represent an integer. However it is possible to provide any string value. An attacker could use this to their advantage to force the application agent to load the RSA public key required for message integrity checking from an unintended location.


MailEnable before 8.60 allows Directory Traversal for reading the messages of other users uploading files and deleting files because \/../\ and \/.. /\ are mishandled.


The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter.


ARC 5.21q allows directory traversal via a full pathname in an archive file.


An

issue

was

discovered

in

Skybox

Platform

before

Directory

Traversal

exists

in

and

via

the

tempFileName

parameter.


The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos parameter in a bpfb_remove_temp_images action.


The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.


The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.


Directory traversal vulnerability in newpost.php in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) sequence and trailing null (%00) byte in the id parameter as demonstrated by injecting a Perl CGI script using \NR\ sequences in the message parameter then calling close.php with modified id and t_id parameters to chmod the script. NOTE: this issue might be resultant from dynamic variable evaluation.


Directory traversal vulnerability in Framework Service component in McAfee ePolicy Orchestrator agent 3.5.0.x and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the directory and filename in a PropsResponse (PackageType) request.


Directory traversal vulnerability in Nullsoft SHOUTcast DSP before 1.9.6 filters directory traversal sequences before decoding which allows remote attackers to read arbitrary files via encoded dot dot (%2E%2E) sequences in an HTTP GET request for a file path containing \/content\.


Directory traversal vulnerability in (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (b) Novell ZENworks 6.2 SR1 and earlier allows remote attackers to overwrite arbitrary files and directories via a .. (dot dot) sequence in the (1) action (2) agentid or (3) index parameters to dagent/nwupload.asp which are used as pathname components.


Directory traversal vulnerability in sources/post.php in Fusion News 1.0 when register_globals is enabled allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the fil_config parameter which can be used to execute PHP code that has been injected into a log file.


Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter which will display a different error message if the file exists.


Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALStemplate parameter as demonstrated by injecting PHP sequences into a log file which is then included by pm.php.


Directory traversal vulnerability in index.php in MKPortal 1.0.1 Final allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language cookie as demonstrated by using a gl_session cookie to inject PHP sequences into the error.log file which is then included by index.php with malicious commands accessible by the ind parameter.


Directory traversal vulnerability in QuickZip 3.06.3 allows remote user-assisted attackers to overwrite arbitrary files or directories via .. (dot dot) sequences in filenames within (1) TAR (2) GZ and (3) JAR archives. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in bb_lib/abbc.css.php in Unclassified NewsBoard (UNB) 1.5.3-d and possibly earlier versions when register_globals is enabled allows remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing null byte (%00) in the design_path parameter. NOTE: this is closely related but a different vulnerability than the ABBCConfigsmileset parameter.


index.php in Destiney Links Script 2.1.2 allows remote attackers to obtain the installation path via an invalid show parameter referencing a non-existent file which reveals the path in the resulting error message. NOTE: this issue might be resultant from a more serious issue such as directory traversal.


Sugar Suite Open Source (SugarCRM) 4.2 and earlier when register_globals is enabled does not protect critical variables such as $_GLOBALS and $_SESSION from modification which allows remote attackers to conduct attacks such as directory traversal or PHP remote file inclusion as demonstrated by modifying the GLOBALSsugarEntry parameter.


SQL injection vulnerability in save.php in PHPSurveyor 0.995 and earlier allows remote attackers to execute arbitrary SQL commands via the surveyid cookie. NOTE: this issue could be leveraged to execute arbitrary PHP code as demonstrated by inserting directory traversal sequences into the database which are then processed by the thissurvey'language' variable.


Directory traversal vulnerability in the IMAP service in EServ/3 3.25 allows remote authenticated users to read other user's email messages create/rename arbitrary directories on the system and delete empty directories via directory traversal sequences in the (1) CREATE (2) SELECT (3) DELETE (4) RENAME (5) COPY or (6) APPEND commands.


Directory traversal vulnerability in smbfs smbfs on FreeBSD 4.10 up to 6.1 allows local users to escape chroot restrictions for an SMB-mounted filesystem via \..\\\\\ sequences. NOTE: this is similar to CVE-2006-1864 but this is a different implementation of smbfs so it has a different CVE identifier.


Multiple directory traversal vulnerabilities in IZArc Archiver 3.5 beta 3 allow remote attackers to write arbitrary files via a ..\\ (dot dot backslash) in a (1) .rar (2) .tar (3) .zip (4) .jar or (5) .gz archive. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in BitZipper 4.1.2 SR-1 and earlier allows remote attackers to create files in arbitrary directories via a .. (dot dot) in the filename of a file that is stored in a (1) RAR (.rar) (2) TAR (.tar) (3) ZIP (.zip) (4) GZ (.gz) or (5) JAR (.jar) archive.


Directory traversal vulnerability in the IMAP server in WinGate 6.1.2.1094 and 6.1.3.1096 and possibly other versions before 6.1.4 Build 1099 allows remote authenticated users to read email of other users or perform unauthorized operations on directories via the (1) CREATE (2) SELECT (3) DELETE (4) RENAME (5) COPY (6) APPEND and (7) LIST commands.


Directory traversal vulnerability in FilZip 3.05 allows remote attackers to write arbitrary files via a .. (dot dot) in a (1) .rar (2) .tar (3) .jar or (4) .gz file. NOTE: the provenance of this information is unknown; the details are obtained from third party information.


Directory traversal vulnerability in action_admin/paysubscriptions.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote authenticated administrators to include and execute arbitrary local PHP files via a .. (dot dot) in the name parameter preceded by enough backspace (%08) characters to erase the initial static portion of a filename.


Directory

traversal

vulnerability

in

in

phpwcms

allows

remote

attackers

to

include

arbitrary

local

files

via

(dot

dot)

sequences

in

the

parameter.

NOTE:

CVE

analysis

suggests

that

this

issue

is

actually

in

SPAW

Editor

PHP

Edition.


Multiple

directory

traversal

vulnerabilities

in

PHP-Fusion

allow

remote

attackers

to

include

and

execute

arbitrary

local

files

via

a

(dot

dot)

in

the

settingslocale

parameter

in

and

a

(dot

dot)

in

the

localeset

parameter

in

setup.php.

NOTE:

the

vendor

states

that

this

issue

might

exist

due

to

problems

in

third

party

local

files.


Directory traversal vulnerability in the xsp component in mod_mono in Mono/C# web server as used in SUSE Open-Enterprise-Server 1 and SUSE Linux 9.2 through 10.0 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in an HTTP request.


Directory traversal vulnerability in the viewfile servlet in the documentation package (resin-doc) for Caucho Resin 3.0.17 and 3.0.18 allows remote attackers to read arbitrary files under other web roots via the contextpath parameter. NOTE: this issue can produce resultant path disclosure when the parameter is invalid.


Directory traversal vulnerability in gallerie.php in SL_site 1.0 allows remote attackers to list images in arbitrary directories via \..\ sequences in the rep parameter which is used to construct a directory name in admin/config.inc.php. NOTE: this issue could be used to produce resultant XSS from an error message.


Directory traversal vulnerability in unb_lib/abbc.conf.php in Unclassified NewsBoard (UNB) 1.6.1 patch 1 and earlier when register_globals is enabled allows remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing null byte (%00) in the ABBCConfigsmileset parameter to unb_lib/abbc.css.php.


Unspecified vulnerability in Secure Elements Class 5 AVR client and server (aka C5 EVM) before 2.8.1 allows authenticated attackers to overwrite arbitrary files (1) on a server during an update or (2) on a client via modified pathnames possibly due to a directory traversal issue.


Directory

traversal

vulnerability

in

Net

Portal

Dynamic

System

(NPDS)

and

earlier

allows

remote

attackers

to

read

arbitrary

files

via

a

(dot

dot)

sequence

and

trailing

byte

in

the

parameter

to

header.php

or

ModPath

parameter

to


Directory traversal vulnerability in randompic.php in pppBLOG 0.3.8 and earlier when register_globals is enabled allows remote attackers to read arbitrary files via a .. (dot dot) sequence in an index of the \file\ array parameter as demonstrated by file0.


Directory traversal vulnerability in Quake 3 engine as used in products including Quake3 Arena Return to Castle Wolfenstein Wolfenstein: Enemy Territory and Star Trek Voyager: Elite Force when the sv_allowdownload cvar is enabled allows remote attackers to read arbitrary files from the server via \..\ sequences in a .pk3 file request.


mainfile.php in XOOPS 2.0.13.2 and earlier when register_globals is enabled allows remote attackers to overwrite variables such as $xoopsOption'nocommon' and conduct directory traversal attacks or include PHP files via (1) xoopsConfiglanguage to misc.php or (2) xoopsConfigtheme_set to index.php as demonstrated by injecting PHP sequences into a log file.


Directory traversal vulnerability in index.php in OnlyScript.info Online Universal Payment System Script allows remote attackers to read arbitrary files via directory traversal sequences in the read parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


** DISPUTED ** Directory traversal vulnerability in workspaces.php in phpXplorer 0.9.33 allows remote attackers to include arbitrary files via a .. (dot dot) and trailing null byte (%00) in the sShare parameter. NOTE: a followup post claims that this is not a vulnerability since the functionality of phpXplorer supports the upload of PHP files which would not cross privilege boundaries since the PHP functionality would support read access outside the web root.


Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 has unspecified impact and attack vectors as identified by Oracle Vuln# REP04. NOTE: Oracle has not disputed reliable researcher claims that this issue is related to directory traversal that allows reading of portions of arbitrary XML files via the customize parameter.


Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to (1) read arbitrary files or trigger an error message path disclosure via \..\ or invalid names in the archive parameter to index.php or (2) include arbitrary files via the template parameter to show_archives.php.


Absolute path directory traversal vulnerability in (1) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (2) VisNetic MailServer before 8.5.0.5 allows remote authenticated users to include arbitrary files via a modified language parameter and a full Windows or UNC pathname in the lang_settings parameter to mail/index.html which is not properly sanitized by the validatefolder PHP function possibly due to an incomplete fix for CVE-2005-4558.


Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.02 allows local users with MyBB administrative privileges to include and possibly execute arbitrary local files via directory traversal sequences and a nul (%00) character in the plugin parameter.


Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS (aka CPG Dragonfly CMS) 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in (1) the newlang parameter and (2) the installlang parameter in a cookie as demonstrated by using error.php to insert malicious code into a log file or uploading a malicious .png file which is then included using install.php.


Multiple unspecified vulnerabilities in Oracle Application Server 6.0.8.26(PS17) and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors as identified by Oracle Vuln# (1) REP05 and (2) REP06 in the Oracle Reports Developer component. NOTE: Oracle has not disputed reliable researcher claims that REP05 is the same as CVE-2005-2378 and REP06 is the same as CVE-2005-2371 both of which involve directory traversal.


Unspecified vulnerability in appserv/main.php in AppServ 2.4.5 allows remote attackers to include arbitrary files via the appserv_root parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. There is not enough detail from these third party sources to know whether this is directory traversal remote file include or another issue.


Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0 ZipMagic Deluxe 9.0 and StuffIt Expander 9.0.0.21 Engine 9.0.0.21 allow remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive.


Multiple directory traversal vulnerabilities in PHP iCalendar 2.0.1 2.1 and 2.2 allow remote attackers to include arbitrary files via the (1) getdate and possibly other parameters used in the replace_files function in search.php and (2) $file variable as used in the parse function in functions/template.php.


Directory traversal vulnerability in OBEX Push services in Toshiba Bluetooth Stack 4.00.23(T) and earlier allows remote attackers to upload arbitrary files to arbitrary remote locations specified by .. (dot dot) sequences as demonstrated by ..\\\\ sequences in the RFILE argument of ussp-push.


Multiple directory traversal vulnerabilities in the IMAP service in Macallan Mail Solution before 4.8.05.004 allow remote authenticated users to read e-mails of other users or create modify or delete directories via a .. (dot dot) in the argument to the (1) CREATE (2) SELECT (3) DELETE or (4) RENAME commands.


Directory traversal vulnerability in action.php in phpXplorer allows remote attackers to read arbitrary files via \..\ (dot dot) sequences and null bytes in the sAction parameter a different vulnerability than CVE-2006-0244. NOTE: if the functionality of phpXplorer supports the upload of PHP files then this issue would not cross privilege boundaries and would not be a vulnerability.


Directory traversal vulnerability in the \remember me\ feature in liveuser.php in PHP Extension and Application Repository (PEAR) LiveUser 0.16.8 and earlier allows remote attackers to determine file existence and possibly delete arbitrary files with short pathnames or possibly read arbitrary files via a .. (dot dot) in the store_id value of a cookie.


Multiple directory traversal vulnerabilities in AIX 5.3 ML03 allow local users to determine the existence of files and read partial contents of certain files via a .. (dot dot) in the argument to (1) getCommand.new (aka getCommand) and (2) getShell a different vulnerability than CVE-2005-4273.


Directory traversal vulnerability in the _setTemplate function in Mambo 4.5.3 4.5.3h and possibly earlier versions allows remote attackers to read and include arbitrary files via the mos_change_template parameter. NOTE: CVE-2006-1794 has been assigned to the SQL injection vector.


Directory

traversal

vulnerability

in

SAP

Business

Connector

(BC)

and

allows

remote

attackers

to

read

or

delete

arbitrary

files

via

the

fullName

parameter

to

or

invoke/sap.monitor.rfcTrace/deleteSingle.

Details

will

be

updated

after

the

grace

period

has

ended.

NOTE:

SAP

Business

Connector

is

an

OEM

version

of

webMethods

Integration

Server.

webMethods

states

that

this

issue

can

only

occur

when

the

product

is

installed

as

root/admin

and

if

the

attacker

has

access

to

a

general

purpose

port;

however

both

are

discouraged

in

the

documentation.

In

addition

the

attacker

must

already

have

acquired

administrative

privileges

through

other

means.


Absolute path directory traversal vulnerability in (a) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (b) VisNetic MailServer before 8.5.0.5 allows remote attackers to include arbitrary files via a full Windows path and drive letter in the (1) language parameter in accounts/inc/include.php and (2) lang_settings parameter in admin/inc/include.php which is not properly sanitized by the securepath function a related issue to CVE-2005-4556.


Directory traversal vulnerability in webftp.php in SysCP WebFTP 1.2.6 and possibly earlier allows remote attackers to include and execute arbitrary local PHP scripts and possibly read other types of files via a .. (dot dot) and a trailing null in the webftp_language parameter.


admin/upload.php in imageVue 16.1 allows remote attackers to upload arbitrary files to certain allowed folders via .. (dot dot) sequences in the path parameter. NOTE: due to the lack of details the specific vulnerability type cannot be determined although it might be due to directory traversal.


Multiple directory traversal vulnerabilities in connector.php in FCKeditor 2.0 FC as used in products such as RunCMS allow remote attackers to list and create arbitrary directories via a .. (dot dot) in the CurrentFolder parameter to (1) GetFoldersAndFiles and (2) CreateFolder.


Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing NULL (%00) byte in (1) the _SESSION'nocc_theme' parameter in (a) html/footer.php; and (2) the lang and (3) theme parameters and the (4) Accept-Language HTTP header field when force_default_lang is disabled in (b) index.php as demonstrated by injecting PHP code into a profile and accessing it using the lang parameter in index.php.


Directory traversal vulnerability in admin/deleteuser.php in HitHost 1.0.0 might allow remote attackers to delete directories (possibly only empty directories) via the $deleteuser variable. NOTE: the initial disclosure for this issue indicated that the researcher was unable to prove this issue; however this might have been due to certain behaviors of rmdir.


Directory traversal vulnerability in main.php in PCPIN Chat 5.0.4 and earlier allows remote authenticated users to include and execute arbitrary PHP code via a \..\ (dot dot) in a language cookie as demonstrated by uploading then accessing a smiliefile image that actually contains PHP code.


Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary files via a .. (dot dot) in the (1) optionlanguage and (2) optiontemplate parameters and (3) possibly other parameters to (a) admin.php and (b) other unspecified scripts. NOTE: the admin.php/optionlanguage vector can be used by remote unauthenticated attackers to include arbitrary files in conjunction with CVE-2006-1085.


Directory traversal vulnerability in index.php in Coppermine 1.4.4 allows remote attackers to read arbitrary files via a .//./ (modified dot dot slash) in the file parameter which causes a regular expression to collapse the sequences into standard \../\ sequences.


Directory traversal vulnerability in install05.php in Simple PHP Blog (SPB) 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the blog_language parameter as demonstrated by injecting PHP sequences into an Apache access_log file which is then included using install05.php.


Directory traversal vulnerability in the editnews module (inc/editnews.mdu) in index.php in CuteNews 1.4.1 allows remote attackers to read or modify files via the source parameter in the (1) editnews or (2) doeditnews action. NOTE: this can also produce resultant XSS when the target file does not exist.


Directory traversal vulnerability in resetpw.php in eschew.net phpBannerExchange 2.0 and earlier and other versions before 2.0 Update 5 allows remote attackers to read arbitrary files via a .. (dot dot) in the email parameter during a \Recover password\ operation (recoverpw.php).


Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendarcookie_language and phpicalendarcookie_style cookies as demonstrated by injecting PHP sequences into an Apache access_log file which is then included by day.php.


Directory traversal vulnerability in index.php in blur6ex 0.3.452 allows remote attackers to include arbitrary files via the shard parameter. NOTE: this issue can be exploited to produce resultant XSS when the parameter has XSS manipulations and path disclosure with other invalid values.


Directory traversal vulnerability in the session handling class (GallerySession.class) in Gallery 2 up to 2.0.2 allows remote attackers to access and delete files by specifying the session in a cookie which is used in constructing file paths before the session value is sanitized.


Directory traversal vulnerability in inc/setLang.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a lang*file parameter as demonstrated by injecting PHP sequences into an Apache access_log file which is then included by index.php.


Directory traversal vulnerability in posts.php in SimpleBBS 1.0.6 through 1.1 allows remote attackers to include and execute arbitrary files via \..\ sequences in the language cookie as demonstrated by by injecting the code into the gl_session cookie of users.php which is stored in error.log.


Directory traversal vulnerability in (1) initiate.php and (2) possibly other PHP scripts in Turnkey Web Tools PHP Live Helper 1.8 and possibly later versions allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the language cookie as demonstrated by uploading PHP code in a gl_session cookie to users.php which causes the code to be stored in error.log which is then included by initiate.php.


Directory traversal vulnerability in the loadConfig function in index.php in phpWebSite 0.10.2 and earlier allows remote attackers to include arbitrary local files and execute arbitrary PHP code via the hub_dir parameter as demonstrated by including access_log. NOTE: in some cases arbitrary remote file inclusion could be performed under PHP 5 using an SMB share argument such as \\\\\systemname\\sharename\.


Multiple directory traversal vulnerabilities in Loudblog before 0.42 allow remote attackers to read or include arbitrary files via a .. (dot dot) and trailing %00 (NULL) byte in the (1) template and (2) page parameters in (a) index.php and the (3) language parameter in (b) inc/backend_settings.php.


Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter as demonstrated by injecting PHP sequences into an Apache error_log file which is then included by doc/index.php.


Multiple directory traversal vulnerabilities in Christian Kindahl TUGZip 3.4.0.0 3.3.0.0 and 3.1.0.2 allow user-assisted attackers to create files in arbitrary directories via a .. (dot dot) in an archive pack with a crafted (1) .gz (2) .jar (3) .rar or (4) .zip file.


Directory traversal vulnerability in Baby FTP Server (BabyFTP) 1.24 allows remote authenticated users to determine existence of files outside the intended document root via unspecified manipulations which generate different error messages depending on whether a file exists or not.


Directory traversal vulnerability in Nodez 4.6.1.1 and earlier allows remote attackers to read or include arbitrary PHP files via a .. (dot dot) in the op parameter as demonstrated by inserting malicious Email parameters into list.gtdat then accessing list.gtdat using the op parameter.


Directory traversal vulnerability in inc/functions.inc.php in CuteNews 1.4.1 and possibly other versions when register_globals is enabled allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the archive parameter in an HTTP POST or COOKIE request which bypasses a sanity check that is only applied to a GET request.


Directory traversal vulnerability in start.php in WebAlbum 2.02 allows remote attackers to include arbitrary files and execute commands by (1) injecting code into local log files via GET commands then (2) accessing that log via a .. (dot dot) sequence and a trailing null (%00) byte in the skin2 COOKIE parameter.


Directory traversal vulnerability in window.php possibly used by home.php in Joshua Muheim phpMyWebmin 1.0 allows remote attackers to obtain sensitive information via a directory name in the target parameter which triggers a directory listing through the opendir function.


Multiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0.5 allow remote authenticated users to read or overwrite arbitrary files via directory traversal sequences in the (1) backup and (2) fragment parameters in a GET request.


Multiple directory traversal vulnerabilities in SeleniumServer FTP Server 1.0 and possibly earlier allow remote attackers to list arbitrary directories read arbitrary files and upload arbitrary files via directory traversal sequences in the (1) DIR (LIST or NLST) (2) GET (RETR) and (3) PUT (STOR) commands.


Directory traversal vulnerability in include/common.php in PunBB before 1.2.14 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the language parameter related to register.php storing a language value in the users table.


Directory traversal vulnerability in classes/index.php in Lithium CMS 4.04c and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the siteconfcurl parameter as demonstrated by a POST to news/comment.php containing PHP code which is stored under db/comments/news/ and included by classes/index.php.


Directory traversal vulnerability in ALTools ALFTP FTP Server 4.1 beta 1 and possibly earlier allows remote attackers to create arbitrary directories via directory traversal sequences in a MKD request. NOTE: the provenance of this information is unknown; details are obtained from third party sources.


Multiple directory traversal vulnerabilities in PhpMyChat Plus 1.9 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the ChatPath parameter to (1) avatar.php (2) colorhelp_popup.php (3) color_popup.php (4) index.php (5) index1.php (6) lib/connected_users.lib.php (7) lib/index.lib.php and (8) phpMyChat.php3; and the (9) L parameter to logs.php. NOTE: CVE analysis suggests that vector 1 might be incorrect.


Directory traversal vulnerability in kgcall.php in KGB 1.87 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the engine parameter as demonstrated by uploading a file containing PHP code with an image/jpeg content type and then referencing this file through the engine parameter.


** DISPUTED ** Directory traversal vulnerability in upgrade.php in phpAdsNew 2.0.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the phpAds_configlanguage parameter. NOTE: this issue could not be reproduced by a third party.


Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) cookie as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by error.php.


Multiple directory traversal vulnerabilities in Conxint FTP Server 2.2.0603 and possibly earlier allow remote attackers to read arbitrary files and list arbitrary directories via directory traversal sequences in (1) DIR (LIST or NLST) and (2) GET (RETR) commands. NOTE: the provenance of this information is unknown; details are obtained from third party sources.


Directory traversal vulnerability in templates/header.php3 in phpMyAgenda 3.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter as demonstrated by a parameter value naming an Apache HTTP Server log file that apparently contains PHP code.


Directory traversal vulnerability in Invision Gallery 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the dir parameter in (1) index.php and (2) forum/index.php when the viewimage command in the gallery module is used.


Directory traversal vulnerability in common.php in Yuuki Yoshizawa Exporia 0.3.0 allows remote attackers to include and execute local files via a .. (dot dot) in the lan parameter to includes.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in lang.php in Rama CMS 0.68 and earlier when register_globals is enabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by lang.php.


Directory traversal vulnerability in index.php in Imageview 5 allows remote attackers to read or execute arbitrary local files via a .. (dot dot) in the user_settings cookie as demonstrated by using the MyFile parameter in albumview.php to upload a text/plain .gif file containing PHP code which is executed by index.php.


Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter followed by a filename ending with \%00\ and a .js filename.


Multiple directory traversal vulnerabilities in Symantec Brightmail AntiSpam (SBAS) before 6.0.4 when the Control Center is allowed to connect from any computer allow remote attackers to read and overwrite certain files via directory traversal sequences in (1) DATABLOB-GET and (2) DATABLOB-SAVE requests.


Directory traversal vulnerability in admin.php in CCleague Pro Sports CMS 1.0.1 RC1 allows remote attackers to read and execute arbitrary local files via a .. (dot dot) sequence and trailing null (%00) byte in the language Cookie parameter as demonstrated by executing PHP code via a log file.


Multiple directory traversal vulnerabilities in cache.php in osCommerce before 2.2 Milestone 2 060817 allow remote attackers to determine existence of arbitrary files and disclose the installation path via a .. (dot dot) in unspecified parameters in the (1) tep_cache_also_purchased (2) tep_cache_manufacturers_box and (3) tep_cache_categories_box functions.


Asterisk 1.2.10 supports the use of client-controlled variables to determine filenames in the Record function which allows remote attackers to (1) execute code via format string specifiers or (2) overwrite files via directory traversals involving unspecified vectors as demonstrated by the CALLERIDNAME variable.


Multiple directory traversal vulnerabilities in (1) login.pl and (2) admin.pl in (a) SQL-Ledger before 2.6.19 and (b) LedgerSMB before 1.0.0p1 allow remote attackers to execute arbitrary Perl code via an unspecified terminal parameter value containing ../ (dot dot slash).


Multiple directory traversal vulnerabilities in Stefan Ernst Newsscript (aka WM-News) 0.5beta allow remote attackers to (1) read arbitrary local files via a .. (dot dot) sequence in the ide parameter in modify.php and (2) write to arbitrary local files via a .. sequence in the var parameter in add_go.php. NOTE: the provenance of this information is unknown; the details are obtained from third party information.


Directory

traversal

vulnerability

in

in

phpGroupWare

and

earlier

allows

remote

attackers

to

include

arbitrary

local

files

via

a

(dot

dot)

sequence

and

trailing

byte

in

the

GLOBALSphpgw_infouserpreferencescommoncountry

parameter.


Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Directory parameter as demonstrated by parameter values naming Apache HTTP Server log files that apparently contain PHP code.


Multiple directory traversal vulnerabilities in Cybozu Office before 6.6 Build 1.3 and Share 360 before 2.5 Build 0.3 allow remote authenticated users to read arbitrary files via a .. (dot dot) sequence via the id parameter in (1) scripts/cbag/ag.exe or (2) scripts/s360v2/s360.exe.


Directory traversal vulnerability in wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier allows remote authenticated users with administrative privileges to read arbitrary files via a .. (dot dot) in the backup parameter to edit.php.


Multiple unrestricted file upload vulnerabilities in (1) back/upload_img.php and (2) admin/upload_img.php in Walter Beschmout PhpQuiz 1.2 and earlier allow remote attackers to upload arbitrary PHP code to the phpquiz/img_quiz folder via the (a) upload (b) ok_update (c) image and (d) path parameters possibly requiring directory traversal sequences in the path parameter.


Directory traversal vulnerability in memcp.php in XMB (Extreme Message Board) 1.9.6 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the langfilenew parameter as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by header.php.


Directory traversal vulnerability in index.php in vbPortal 3.0.2 through 3.6.0 Beta 1 when magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bbvbplang cookie as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by index.php.


Directory traversal vulnerability in index.php in Exponent CMS 0.96.3 allows remote attackers to read and execute arbitrary local files via a .. (dot dot) sequence in the view parameter in the show_view action in the calendarmodule module as demonstrated by executing PHP code through session files.


Simple Machines Forum (SMF) 1.1RCx before 1.1RC3 and 1.0.x before 1.0.8 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value which allows remote attackers to perform directory traversal attacks to read arbitrary local files lock topics and possibly have other security impacts. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so then this should not be treated as a vulnerability in Simple Machines Forum.


Directory traversal vulnerability in pbd_engine.php in Php Blue Dragon 2.9.1 and earlier allows remote attackers to read and execute arbitrary local files via a .. (dot dot) sequence via the phpExt parameter as demonstrated by executing PHP code in a log file.


Directory traversal vulnerability in Computer Associates (CA) eTrust Security Command Center 1.0 and r8 up to SP1 CR2 allows remote authenticated users to read and delete arbitrary files via \..\ sequences in the eSCCAdHocHtmlFile parameter to eSMPAuditServlet which is not properly handled by the getadhochtml function.


Directory traversal vulnerability in footer.php in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to read and include arbitrary local files via a .. (dot dot) sequence in the template parameter. NOTE: this was later reported to affect 1.0.1 and demonstrated for code execution by uploading and accessing an avatar file.


Multiple directory traversal vulnerabilities in the G/PGP (GPG) Plugin 2.0 and 2.1dev before 20070614 for Squirrelmail allow remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the help parameter to (1) gpg_help.php or (2) gpg_help_base.php.


Directory traversal vulnerability in IPCheck Server Monitor before 5.3.3.639/640 allows remote attackers to read arbitrary files via modified .. (dot dot) sequences in the URL including (1) \..%2f\ (encoded \/\ slash) \..../\ (multiple dot) and \..%255c../\ (double-encoded \\\\ backslash).


Directory traversal vulnerability in A.l-Pifou 1.8p2 allows remote attackers to read arbitrary files via \..\ sequences in the ze_langue_02 cookie as demonstrated by using the choix_lng parameter to choix_langue.php to indirectly set the cookie then accessing livre_dor.php to trigger the inclusion from inc/change_lang_ck.php possibly related to livre_livre.php. NOTE: the livre_livre.php relationship has been reported by some third party sources.


Multiple directory traversal vulnerabilities in Alt-N WebAdmin 3.2.3 and 3.2.4 running with MDaemon 9.0.5 and possibly earlier allow remote authenticated global administrators to read arbitrary files via a .. (dot dot) in the file parameter to (1) logfile_view.wdm and (2) configfile_view.wdm.


Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0 when register_globals is enabled and magic_quotes_gpc is disabled allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the configdb_type parameter to (1) categories.php (2) couriers.php (3) orders.php and (4) products.php in actions_admin/; and (5) orders.php and (6) products.php in actions_client/; as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by one of these PHP scripts.


Directory traversal vulnerability in admin/templates_boxes_layout.php in osCommerce 3.0a3 allows remote attackers to include and execute arbitrary PHP files via a .. (dot dot) in the filter parameter. NOTE: this issue can be leveraged to obtain full path information in error messages.


Multiple

directory

traversal

vulnerabilities

in

Serendipity

and

earlier

allow

remote

attackers

to

read

or

include

arbitrary

local

files

via

a

(dot

dot)

sequence

in

the

serendipitycharset

parameter

in

include/lang.inc.php;

or

to

plugins/

scripts

serendipity_event_bbcode/serendipity_event_bbcode.php

serendipity_event_browsercompatibility/serendipity_event_browsercompatibility.php

serendipity_event_contentrewrite/serendipity_event_contentrewrite.php

serendipity_event_creativecommons/serendipity_event_creativecommons.php

serendipity_event_emoticate/serendipity_event_emoticate.php

serendipity_event_entryproperties/serendipity_event_entryproperties.php

serendipity_event_karma/serendipity_event_karma.php

serendipity_event_livesearch/serendipity_event_livesearch.php

serendipity_event_mailer/serendipity_event_mailer.php

serendipity_event_searchhighlight/serendipity_event_searchhighlight.php

serendipity_event_spamblock/serendipity_event_spamblock.php

serendipity_event_spartacus/serendipity_event_spartacus.php

serendipity_event_statistics/serendipity_plugin_statistics.php

serendipity_event_templatechooser/serendipity_event_templatechooser.php

serendipity_event_textile/serendipity_event_textile.php

serendipity_event_textwiki/serendipity_event_textwiki.php

serendipity_event_trackexits/serendipity_event_trackexits.php

serendipity_event_weblogping/serendipity_event_weblogping.php

serendipity_event_xhtmlcleanup/serendipity_event_xhtmlcleanup.php

serendipity_plugin_comments/serendipity_plugin_comments.php

serendipity_plugin_creativecommons/serendipity_plugin_creativecommons.php

serendipity_plugin_entrylinks/serendipity_plugin_entrylinks.php

serendipity_plugin_eventwrapper/serendipity_plugin_eventwrapper.php

serendipity_plugin_history/serendipity_plugin_history.php

serendipity_plugin_recententries/serendipity_plugin_recententries.php

serendipity_plugin_remoterss/serendipity_plugin_remoterss.php

serendipity_plugin_shoutbox/serendipity_plugin_shoutbox.php

and

and

serendipity_plugin_templatedropdown/serendipity_plugin_templatedropdown.php.


Directory traversal vulnerability in includes/search/search_mdforum.php in MAXdev MDForum 2.0.1 and earlier when magic_quotes_gpc is disabled and register_globals is enabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang cookie to error.php as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by error.php.


Directory traversal vulnerability in viewnfo.php in (1) TorrentFlux before 2.2 and (2) torrentflux-b4rt before 2.1-b4rt-972 allows remote authenticated users to read arbitrary files via .. (dot dot) sequences in the path parameter a different vector than CVE-2006-6328.


Directory traversal vulnerability in SAP Internet Graphics Service (IGS) 6.40 Patchlevel 16 and earlier and 7.00 Patchlevel 6 and earlier allows remote attackers to delete arbitrary files via directory traversal sequences in an HTTP request. NOTE: This information is based upon an initial disclosure. Details will be updated after the grace period has ended. This issue is different from CVE-2006-4133 and CVE-2006-4134.


Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0 when register_globals is enabled and magic_quotes_gpc is disabled allow remote attackers to include arbitrary files via a .. (dot dot) in the configdb_type parameter to (1) actions_admin/other.php and (2) actions_client/gallery.php. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the f parameter as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by index.php.


Directory traversal vulnerability in SAFileUpSamples/util/viewsrc.asp in SoftArtisans FileUp (SAFileUp) 5.0.14 allows remote attackers to read arbitrary files via a %c0%ae. (Unicode dot dot) in the path parameter which bypasses the checks for \..\ sequences.


Directory traversal vulnerability in include/config.php in E-Uploader Pro 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a .. (dot dot) in the language parameter as demonstrated by uploading a .JPG file containing PHP code then accessing the file via config.php.


Multiple directory traversal vulnerabilities in Simple PHP Blog (SPHPBlog) probably 0.4.8 allow remote attackers to read arbitrary files and possibly include arbitrary PHP code via a .. (dot dot) sequence in the blog_theme parameter in (1) index.php (2) add_cgi.php (3) add_link.php (4) login.php (5) template.php or (6) contact.php.


Multiple directory traversal vulnerabilities in (a) class/functions.php and (b) class/m_bro.php in AlternC 0.9.5 and earlier allow remote attackers to (1) create arbitrary files and directories via a .. (dot dot) in the \create name\ field and (2) read arbitrary files via a .. (dot dot) in the \web root\ field when configuring a subdomain.


Directory traversal vulnerability in downloadexcel.php in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to read arbitrary files via the fn parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


** DISPUTED ** Directory traversal vulnerability in WBmap.php in WikyBlog 1.3.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter. NOTE: CVE disputes this vulnerability because l is validated by ctype_alpha before use.


Directory traversal vulnerability in language.php in phpAlbum 0.4.1 Beta 6 and earlier when magic_quotes_gpc is disabled and register_globals is enabled allows remote attackers to include and execute arbitrary local files or obtain sensitive information via a .. (dot dot) in the pa_langinclude_file parameter as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by language.php.


Directory traversal vulnerability in index.php in plx Web Studio (aka plxWebDev) plx Pay 3.2 and earlier allows remote attackers to include and execute arbitrary local files or obtain user credentials and other sensitive information via a .. (dot dot) in the read parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


administration/telecharger.php in Cahier de texte 2.0 allows remote attackers to obtain unparsed content (source code) of files via the chemin parameter as demonstrated using directory traversal sequences to obtain the MySQL username and password from conn_cahier_de_texte.php. NOTE: it is not clear whether the scope of this issue extends above the web document root and whether directory traversal is the primary vulnerability.


Multiple directory traversal vulnerabilities in PHPBuilder 0.0.2 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to (1) lib/htm2php.php and (2) sitetools/htm2php.php. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in error.php in Envolution 1.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) parameter as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by error.php.


Directory traversal vulnerability in FolderManager/FolderManager.aspx in Hosting Controller 7c allows remote authenticated users to read and modify arbitrary files and list arbitrary directories via ..\\ (dot dot backslash) sequences in the BrowsePath parameter.


Directory traversal vulnerability in Sorin Chitu Telnet-FTP Server 1.0 allows remote authenticated users to list contents of arbitrary directories and download arbitrary files via a .. (dot dot) sequence in an FTP command argument as demonstrated by RETR (GET) or STOR (PUT). NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


modules/viewcategory.php in Minh Nguyen Duong Obie Website Mini Web Shop 2.1.c allows remote attackers to obtain sensitive information via a request with an arbitrary catname parameter but no itemsdb parameter which reveals the path in an error message. NOTE: CVE analysis suggests that this error might be resultant from a more serious issue such as directory traversal.


Directory traversal vulnerability in index.php in SolarPay allows remote attackers to read certain files via a .. (dot dot) in the read parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in error.php in MD-Pro 1.0.76 and earlier allows remote authenticated users to read and include arbitrary files via the PNSVlang cookie as demonstrated by uploading a GIF image using AddDownload or injecting PHP code into a log file then accessing it.


Directory traversal vulnerability in avatar.php in PhpMyChat Plus 1.9 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the L parameter a different issue than CVE-2006-5897. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple directory traversal vulnerabilities in EZOnlineGallery 1.3 and earlier and possibly other versions before 1.3.2 Beta allow remote attackers to (1) determine directory existence via a \..\ in the album parameter in a show_album action to (a) ezgallery.php which produces different responses depending on existence; and read arbitrary image files via a \..\ in the album or (2) image parameter to (b) image.php.


Multiple directory traversal vulnerabilities in Kubix 0.7 and earlier allow remote attackers to (1) include and execute arbitrary local files via \..\ sequences in the theme cookie to index.php which is not properly handled by includes/head.php; and (2) read arbitrary files via \..\ sequences in the file parameter in an add_dl action to adm_index.php as demonstrated by reading connect.php.


Directory traversal vulnerability in AspUpload 2.1 in certain configurations allows remote attackers to upload and read arbitrary files and list arbitrary directories via a .. (dot dot) in the Filename parameter in (1) UploadScript11.asp or (2) DirectoryListing.asp.


Directory traversal in Webpaging interface in Internet Software Solutions Air Messenger LAN Server (AMLServer) 3.4.2 allows allows remote attackers to read arbitrary files via a .. (dot dot) attack.


eEye SecureIIS versions 1.0.3 and earlier allows a remote attacker to bypass filtering of requests made to SecureIIS by escaping HTML characters within the request which could allow a remote attacker to use restricted variables and perform directory traversal attacks on vulnerable programs that would otherwise be protected.


Directory traversal in DataWizard WebXQ server 1.204 allows remote attackers to view files outside of the web root via a .. (dot dot) attack.


compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ (dot dot dot slash dot slash) sequence.


Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the logfilename parameter to (1) b2b/admin/log.jsp or (2) b2b/admin/log_view.jsp in the Internet Sales (crm.b2b) component or (3) ipc/admin/log.jsp or (4) ipc/admin/log_view.jsp in the Application Administration (com.sap.ipc.webapp.ipc) component.


Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a .. (dot dot) in the filename parameter in a SetTaskLogByFile SOAP request.


Multiple

directory

traversal

vulnerabilities

in

the

Get

Template

feature

in

in

AjaXplorer

before

and

before

allow

remote

attackers

to

include

and

execute

arbitrary

local

files

via

a

(dot

dot)

in

the

pluginName

or

pluginPath

parameter

in

a

action.

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


The default configuration of Movable Type before 4.38 5.0x before 5.07 and 5.1x before 5.13 supports the \mt:Include file=\ attribute which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files by leveraging the template-designer role.


Multiple

directory

traversal

vulnerabilities

in

the

iBrowser

plugin

library

as

used

in

Open

Journal

Systems

before

allow

remote

authenticated

users

to

delete

or

rename

arbitrary

files

via

a

(dot

dot)

in

the

param

parameter

to


Directory traversal vulnerability in the Local TFTP file-upload application on Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allows remote authenticated users to upload software to arbitrary directories via unspecified vectors aka Bug ID CSCtw56009.


Directory traversal vulnerability in edituser.php in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the icmsConfigPluginssanitizer_plugins parameter.


Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php (3) view_form.php or (4) trend_form.php in interface/patient_file/encounter.


Directory traversal vulnerability in javatester_init.php in IBM Lotus Protector for Mail Security 2.1 2.5 2.5.1 and 2.8 and IBM ISS Proventia Network Mail Security System allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the template parameter.


Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1) when used over libvirt-based hypervisors allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute of a file element.


Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18 and Puppet Enterprise before 2.5.2 when Delete is enabled in auth.conf allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.


Directory traversal vulnerability in index.php in phpMoneyBooks 1.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter a different vulnerability than CVE-2012-1669. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this issue might have been fixed in 1.0.3.


Directory

traversal

vulnerability

in

in

CMS

Made

Simple

(CMSMS)

before

allows

remote

authenticated

administrators

to

delete

arbitrary

files

via

a

(dot

dot)

in

the

deld

parameter.

NOTE:

this

can

be

leveraged

using

CSRF

to

allow

remote

attackers

to

delete

arbitrary

files.


Multiple directory traversal vulnerabilities in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allow remote attackers to read arbitrary files via port-46824 TCP packets specifying a file-open operation with opcode 0x78 and a .. (dot dot) in a pathname followed by a file-read operation with opcode (1) 0x96 (2) 0x97 or (3) 0x98.


Directory traversal vulnerability in the XML Server in IOServer before 1.0.19.0 when the Root Directory pathname lacks a trailing \\ (backslash) character allows remote attackers to read arbitrary files or list arbitrary directories via a .. (dot dot) in a URI.


Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a .. (dot dot) in (1) the fileName parameter in a download action to source/loggin/page_log_dwn_file.hsp or the fileName parameter in (2) an edit action or (3) a delete action to the default URI.


Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway (SMG) 9.5.x allow remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) logFile parameter in a logs action to brightmail/export or (2) localBackupFileSelection parameter in an APPLIANCE restoreSource action to brightmail/admin/restore/download.do.


Multiple directory traversal vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) language parameter to learn/cubemail/install.php or (2) f parameter learn/cubemail/filemanagement.php or execute arbitrary local files via a .. (dot dot) in the (3) config parameter to learn/cubemail/menu.php.


Directory traversal vulnerability in gitolite 3.x before 3.1 when wild card repositories and a pattern matching \../\ are enabled allows remote authenticated users to create arbitrary repositories and possibly perform other actions via a .. (dot dot) in a repository name.


Directory traversal vulnerability in index.php in phpPaleo 4.8b180 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phppaleo4_lang cookie a different vulnerability than CVE-2012-1671. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0 as used in Apache CouchDB before 1.0.4 1.1.x before 1.1.2 and 1.2.x before 1.2.1 allows remote attackers to read arbitrary files via a ..\\ (dot dot backslash) in the default URI.


Multiple directory traversal vulnerabilities on the Huawei E585 device allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the PATH_INFO of an sdcard/ request or (2) modify arbitrary files via a .. (dot dot) in the req_page parameter to en/sms.cgi.


Directory

traversal

vulnerability

in

the

PostScript

Interpreter

as

used

on

the

HP

LaserJet

and

LaserJet

Enterprise

Color

LaserJet

and

Color

LaserJet

Enterprise

and

Digital

Sender

with

model-dependent

firmware

through

allows

remote

attackers

to

read

arbitrary

files

via

unknown

vectors.


Directory traversal vulnerability in the set_log_config function in regclnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote authenticated users to create or overwrite arbitrary files via directory traversal sequences in a log pathname.


Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13.9 build 120201 Rel.54965n and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to the help/ URI.


Open

Networking

Foundation

(ONF)

ONOS

version

and

earlier

version

contains

a

Directory

Traversal

vulnerability

in

line

that

can

result

in

arbitrary

file

deletion

(overwrite).

This

attack

appear

to

be

exploitable

via

a

specially

crafted

zip

file

should

be

uploaded.


The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a \from\ and \to\ filename) via a ../ directory traversal in the dir parameter of an mrelocator_rename action to the wp-admin/admin-ajax.php URI.


in

YUNUCMS

allows

arbitrary

file

deletion

via

the

statics/ueditor/php/controller.php?action=remove

key

parameter

as

demonstrated

by

using

directory

traversal

to

delete

the

install.lock

file.


in

SDCMS

allows

reading

arbitrary

files

via

a

/?m=plug&c=admin&a=index&p=attachment&root=

directory

traversal.

The

value

of

the

root

parameter

must

be

encoded

(note

that

encoding

instead

of

URL

encoding

is

very

rare

in

a

directory

traversal

attack

vector).


Zyxel VMG1312-B10D devices before 5.13(AAXA.8)C0 allow ../ Directory Traversal as demonstrated by reading /etc/passwd.


OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive.


The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\\SYSTEM access via Directory Traversal by leveraging full access to the associated OSSEC server.


The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mrelocator_move action to the wp-admin/admin-ajax.php URI.


An issue was discovered in LAOBANCMS 2.0. It allows arbitrary file deletion via ../ directory traversal in the admin/pic.php del parameter as demonstrated by deleting install/install.txt to permit a reinstallation.


Tarantella Enterprise before 3.11 allows Directory Traversal.


The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.


LAOBANCMS 2.0 allows install/mysql_hy.php?riqi=../ Directory Traversal.


GitLab CE/EE before 11.3.12 11.4.x before 11.4.10 and 11.5.x before 11.5.3 allows Directory Traversal in Templates API.