Directory traversal vulnerability in the Web Calendaring server in Ipswitch Imail 8.13 and other versions before IMail Server 8.2 Hotfix 2 allows remote attackers to read arbitrary files via \..\\\ (dot dot backslash) sequences in the query string argument in a GET request to a non-existent .jsp file.


Multiple

directory

traversal

vulnerabilities

in

Mercur

Messaging

allow

remote

attackers

to

perform

unauthorized

file

operations

via

the

Folder.Id

parameter

to

deletefolder.ctml

deletemessage.ctml

origmessage.ctml

or

readmessage.ctml

the

Message.Id

parameter

to

editmessage.ctml

or

the

Message.Command

parameter

to

messages.ctml.


Multiple directory traversal vulnerabilities in Argosoft Mail Server Pro 1.8.7.6 allow remote authenticated users to (1) read arbitrary files via the UIDL parameter to the msg script or (2) copy or move the user's .eml file to arbitrary locations via the delete script a different vulnerability than CVE-2005-0367.


Directory traversal vulnerability in the Crystal Report component (rptserver.asp) in Trend Micro ServerProtect Management Console 5.58 as used in Control Manager 2.5 and 3.0 and Damage Cleanup Server 1.1 and possibly earlier versions allows remote attackers to read arbitrary files via the IMAGE parameter.


Directory traversal vulnerability in the IMAP service for SPA-PRO Mail @Solomon 4.00 allows remote authenticated users to read other users' mail and perform operations on arbitrary directories via .. sequences in the (1) SELECT (2) CREATE (3) DELETE and (4) RENAME commands.


Multiple directory traversal vulnerabilities in SitePanel 2.6.1 and earlier (SitePanel2) allows remote attackers to (1) delete arbitrary files via the id parameter in a rmattach action to 5.php or (2) read arbitrary files via the lang parameter to index.php.


** DISPUTED ** Directory traversal vulnerability in the third party tool from NetIQ as used to secure the iSeries AS/400 FTP server allows remote attackers to access arbitrary files including those from qsys.lib via \..\ sequences in a GET request. NOTE: the vendor has disputed this issue saying that \neither NetIQ Security Manager nor our iSeries Security Solutions are vulnerable.\


Multiple directory traversal vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1 and possibly earlier versions allows remote attackers to (1) delete arbitrary files or directories via a relative path to the id parameter to logout.html or (2) include arbitrary PHP files or other files via the helpid parameter to help.html.


Directory traversal vulnerability in the archive decompression library in AhnLab V3Pro 2004 build 6.0.0.383 V3 VirusBlock 2005 build 6.0.0.383 and V3Net for Windows Server 6.0 build 6.0.0.383 allows remote attackers to write arbitrary files via a .. (dot dot) in the filename in a compressed archive.


Directory traversal vulnerability in Google Mini Search Appliance and possibly Google Search Appliance allows remote attackers to determine the existence of arbitrary files via a relative path from a style sheet directory then comparing the resulting error messages.


Directory traversal vulnerability in the IMAP service (meimaps.exe) of MailEnable Professional 1.6 and earlier and Enterprise 1.1 and earlier allows remote attackers to create or rename arbitrary mail directories via the mailbox name argument of the (1) create or (2) rename commands.


Multiple directory traversal vulnerabilities in GuppY 4.5.9 and earlier allow remote attackers to read and include arbitrary files via (1) the meskin parameter to admin/editorTypetool.php or the lng parameter to the in admin/inc scripts (2) archbatch.php (3) dbbatch.php and (4) nwlmail.php.


Multiple directory traversal vulnerabilities in index.php in phpSysInfo 2.4 and earlier as used in phpgroupware 0.9.16 and earlier and egrouwpware before 1.0.0.009 allow remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) sensor_program parameter or the (2) _SERVERHTTP_ACCEPT_LANGUAGE parameter which overwrites an internal variable a variant of CVE-2003-0536. NOTE: due to a typo in an advisory an issue in osh was inadvertently linked to this identifier; the proper identifier for the osh issue is CVE-2005-3346.


Directory traversal vulnerability in NeroNET 1.2.0.2 and earlier allows remote attackers to read arbitrary files with certain file extensions (such as ZIP AVI JPG TXT and HTML) via \..\ and hex-encoded (1) slash \/\ (\%2f\) or (2) backslash \\\\ (\%5c\) sequences.


Multiple directory traversal vulnerabilities in index.php in vTiger CRM 4.2 and earlier allow remote attackers to read or include arbitrary files an ultimately execute arbitrary PHP code via .. (dot dot) and null byte (\%00\) sequences in the (1) module parameter and (2) action parameter in the Leads module as also demonstrated by injecting PHP code into log messages and accessing the log file.


index.php in ActiveCampaign SupportTrio 1.4 and earlier allows remote attackers to read or include arbitrary files via the page parameter possibly due to a directory traversal vulnerability.


Directory traversal vulnerability in security.inc.php in AzDGDatingLite 2.1.3 and possibly earlier versions allows remote attackers to execute arbitrary PHP commands via \..\ sequences and \%00\ (trailing null byte) characters in the l parameter which is used in an include_once statement.


Directory traversal vulnerability in HAURI Anti-Virus products including ViRobot Expert 4.0 Advanced Server Linux Server 2.0 and LiveCall allows remote attackers to overwrite arbitrary files via \..\ sequences in filenames contained in (1) ACE (2) ARJ (3) CAB (4) LZH (5) RAR (6) TAR and (7) ZIP files.


The mysql_create_function function in sql_udf.cc for MySQL 4.0 before 4.0.25 4.1 before 4.1.13 and 5.0 before 5.0.7-beta when running on Windows uses an incomplete blacklist in a directory traversal check which allows attackers to include arbitrary files via the backslash (\\) character.


Multiple directory traversal vulnerabilities in Dokeos 1.6 and earlier and possibly Claroline allow remote attackers to (1) delete arbitrary files or directories via the delete parameter to claroline/scorm/scormdocument.php (2) move arbitrary files via the move_to and move_file parameters to claroline/document/document.php or determine the existence of arbitrary files via the file parameter to (3) claroline/scorm/showinframes.php or (4) claroline/scorm/contents.php.


Just another flat file (JAF) CMS before 3.0 Final allows remote attackers to obtain sensitive information via (1) an * (asterisk) in the id parameter (2) a blank id parameter or (3) an * (asterisk) in the disp parameter to index.php which reveals the path in an error message. NOTE: a followup suggests that this may be a directory traversal or file inclusion vulnerability.


Directory traversal vulnerability in kvarcve.dll in Autonomy (formerly Verity) KeyView SDK before 9.2.0 as used in Lotus Notes 6.5.4 and 7.0 allows remote attackers to delete arbitrary files via a (1) ZIP (2) UUE or (3) TAR archive that contains a .. (dot dot) in the filename which is not properly handled when generating a preview.


Zoo 2.10 has Directory traversal


Directory traversal vulnerability in SaveWebPortal 3.4 allows remote attackers to include arbitrary files and execute arbitrary local PHP programs via \..\ sequences in the (1) SITE_Path parameter to menu_dx.php or (2) CONTENTS_Dir parameter to menu_sx.php.


Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat parameters to rwservlet. NOTE: vector 2 is probably the same as CVE-2006-0289 and fixed in Jan 2006 CPU.


Directory traversal vulnerability in source.php in Quick & Dirty PHPSource Printer 1.1 and earlier allows remote attackers to read arbitrary files via \.../...//\ sequences in the file parameter which are reduced to \../\ when PHPSource Printer uses a regular expression to remove \../\ sequences.


Directory traversal vulnerability in Oracle Reports 6.0 6i 9i and 10g allows remote attackers to overwrite arbitrary files via (1) \..\ (2) Windows drive letter (C:) and (3) absolute path sequences in the desname parameter. NOTE: this issue was probably fixed by REP06 in CPU Jan 2006 in which case it overlaps CVE-2006-0289.


Directory traversal vulnerability in a third-party compression library (UNACEV2.DLL) as used in avast! Antivirus Home/Professional Edition 4.6.665 and Server Edition 4.6.460 allows remote attackers to write arbitrary files via an ACE archive containing filenames with (1) .. or (2) absolute pathnames.


Directory traversal vulnerability in PHPKIT 1.6.1 R2 and earlier might allow remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the path parameter and a %00 at the end of the filename as demonstrated by an avatar filename ending with .png%00.


Unspecified vulnerability in index.php in PEARLINGER Pearl Forums 2.4 allows remote attackers to include arbitrary files via the mode parameter possibly due to a directory traversal vulnerability. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remote attackers to include arbitrary local files via \..\ sequences in the beanFiles array parameter.


dir/include.html in IceWarp Web Mail 5.5.1 as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1 allows remote attackers to include arbitrary local files via a null byte (%00) in the lang parameter possibly due to a directory traversal vulnerability.


Multiple directory traversal vulnerabilities in LogiSphere 0.9.9j allow remote attackers to access arbitrary files via (1) .. (dot dot) (2) \...\ (triple dot) and (3) \..//\ sequences in the URL (4) \../\ sequences in the source parameter to viewsource.jsp or (5) \..\\\ (dot dot backslash) sequences in the NS-query-pat parameter to the search URL. URL.


Directory traversal vulnerability in function_foot_1.inc.php for Thorsten Korner 123tkShop before 0.3.1 allows remote attackers to read arbitrary files via .. (dot dot) sequences terminated by a null character in the $designNo variable which is part of an \include\ function call.


Directory traversal vulnerability in CommuniGate Pro 4.0b4 and possibly earlier versions allows remote attackers to list the contents of the WebUser directory and its parent directory via a (1) .. (dot dot) or (2) . (dot) in a URL. NOTE: it is not clear whether this issue reveals any more information regarding directory structure than is already available to any CommuniGate Pro user although there is a possibility that it could be used to infer product version information.


MDG Computer Services Web Server 4D/eCommerce 3.5.3 allows remote attackers to exploit directory traversal vulnerability via a ../ (dot dot) containing URL-encoded slashes in the HTTP request.


Directory traversal vulnerability in GoAhead Web Server 2.1 allows remote attackers to read arbitrary files via a URL with an encoded / (%5C) in a .. (dot dot) sequence. NOTE: it is highly likely that this candidate will be REJECTED because it has been reported to be a duplicate of CVE-2001-0228.


Directory traversal vulnerability in Jon Hedley AlienForm2 (typically installed as af.cgi or alienform.cgi) allows remote attackers to read or modify arbitrary files via an illegal character in the middle of a .. (dot dot) sequence in the parameters (1) _browser_out or (2) _out_file.


Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25 and possibly later versions allows attackers to overwrite arbitrary files during archive extraction via a (1) \/..\ or (2) \./..\ string which removes the leading slash but leaves the \..\ a variant of CVE-2001-1267.


Directory traversal vulnerability in ans.pl in Avenger's News System (ANS) 2.11 and earlier allows remote attackers to determine the existence of arbitrary files or execute any Perl program on the system via a .. (dot dot) in the p parameter which reads the target file and attempts to execute the line using Perl's eval function.


Directory traversal vulnerability in (1) Deerfield D2Gfx 1.0.2 or (2) BadBlue Enterprise Edition 1.5.x and BadBlue Personal Edition 1.5.6 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in the script used to read Microsoft Office documents.


Directory traversal vulnerability in Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6 and Novell Small Business Suite 5.1 and 6 allows remote attackers to read arbitrary files via a URL containing a \..%5c\ sequence (modified dot-dot) which is mapped to the directory separator.


Directory traversal vulnerability in RadioBird Software WebServer 4 Everyone 1.23 and 1.27 and other versions before 1.30 allows remote attackers to read arbitrary files via an HTTP request with \..\ (dot-dot) sequences containing URL-encoded forward slash (\%2F\) characters.


Directory traversal vulnerability in search engine for iPlanet web server 6.0 SP2 and 4.1 SP9 and Netscape Enterprise Server 3.6 when running on Windows platforms allows remote attackers to read arbitrary files via ..\\ (dot-dot backslash) sequences in the NS-query-pat parameter.


The getdbm procedure in ypxfrd allows local users to read arbitrary files and remote attackers to read databases outside /var/yp via a directory traversal and symlink attack on the domain and map arguments.


Directory traversal vulnerabilities in ezContents 1.41 and earlier allow remote attackers to cause ezContents to (1) create directories using the Maintain Images:Add New:Create Subdirectory item or (2) list directories using the Maintain Images file listing via .. (dot dot) sequences.


Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary files via a hex-encoded \%c0%ae%c0%ae\ string which is the Unicode representation for \..\ (dot dot).


Directory traversal vulnerabilities in multiple FTP clients on UNIX systems allow remote malicious FTP servers to create or overwrite files as the client user via filenames containing /absolute/path or .. (dot dot) sequences.


Directory traversal vulnerability in the list_directory function in Icecast 1.3.12 allows remote attackers to determine if a directory exists via a .. (dot dot) in the GET request which returns different error messages depending on whether the directory exists or not.


Multiple directory traversal vulnerabilities in the (a) \Unzip archive\ and (b) \Upload files and archives\ functionality in net2ftp 0.96 stable and 0.97 beta allow remote attackers to create read or delete arbitrary files via a .. (dot dot) in a filename within a (1) TAR or (2) ZIP archive. NOTE: this can be leveraged for code execution by creating a .php file.


Directory traversal vulnerability in print.php in PHP iCalendar 2.24 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cookie_language parameter in a phpicalendar_* cookie a different vector than CVE-2006-1292.


Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group (2) artifact (3) version or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet); the (5) createDB parameter to console/portal/Embedded DB/DB Manager (aka the Embedded DB/DB Manager portlet); or the (6) filename parameter to the createKeystore script in the Security/Keystores portlet.


Directory traversal vulnerability in index.php in eDreamers eDContainer 2.22 when magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lg parameter. NOTE: some of these details are obtained from third party information.


Multiple directory traversal vulnerabilities in Jonascms 1.2 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the taal parameter to (1) backup.php and (2) gb_voegtoe.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple directory traversal vulnerabilities in Aperto Blog 0.1.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) action parameter to admin.php and the (2) get parameter to index.php. NOTE: in some environments this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp ftps or ssh2.sftp URL.


Directory traversal vulnerability in eDNews_archive.php in eDreamers eDNews 2 when magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lg parameter. NOTE: some of these details are obtained from third party information.


Directory traversal vulnerability in Yerba SACphp 6.3 allows remote attackers to read arbitrary files and possibly have other impact via directory traversal sequences in the mod field contained in the base64-encoded SID parameter to an unspecified component. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple directory traversal vulnerabilities in AIST NetCat 3.12 and earlier when magic_quotes_gpc is disabled and register_globals is enabled allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the system parameter in modules/netshop/post.php; and the INCLUDE_FOLDER parameter in (2) auth.inc.php (3) banner.inc.php (4) blog.inc.php and (5) forum.inc.php in modules/.


Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress when magic_quotes_gpc is disabled allows remote attackers to read arbitrary files via a .. (dot dot) in the book_id parameter. NOTE: some of these details are obtained from third party information.


PHP remote file inclusion vulnerability in show_joined.php in Indiscripts Enthusiast 3.1.4 and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: the researcher also points out the analogous directory traversal issue.


Apache Tomcat 4.1.0 through 4.1.39 5.5.0 through 5.5.27 6.0.0 through 6.0.18 and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.


Multiple

directory

traversal

vulnerabilities

in

PowerAward

when

is

enabled

allow

remote

attackers

to

include

and

execute

arbitrary

local

files

via

directory

traversal

sequences

in

the

lang

parameter

to

agb.php

angemeldet.php

anmelden.php

charts.php

guestbook.php

impressum.php

index.php

rss-reader.php

statistic.php

teilnehmer.php

topsites.php

votecode.php

voting.php

and

winner.php.


Directory traversal vulnerability in idm/includes/helpServer.jsp in Sun Java System Identity Manager 6.0 through 6.0 SP4 7.0 and 7.1 allows remote attackers to read arbitrary files in the filesystem of the IDM server via directory traversal sequences in the ext parameter.


Multiple

directory

traversal

vulnerabilities

in

Fred

Stuurman

SyndeoCMS

allow

remote

authenticated

users

to

read

arbitrary

files

via

a

(dot

dot)

in

the

template

parameter

to

reached

through

starnet/index.php;

and

reached

through

starnet/index.php.


Multiple directory traversal vulnerabilities in playSMS 0.9.3 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) gateway_module parameter to plugin/gateway/gnokii/init.php and the (2) themes_module parameter to plugin/themes/default/init.php.


Multiple directory traversal vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier when magic_quotes_gpc is disabled and register_globals is enabled allow remote attackers to include and execute arbitrary files via a .. (dot dot) in the (1) boxname parameter to theme/superchrome/box.php and the (2) theme parameter to phpclanwebsite/footer.php.


Multiple directory traversal vulnerabilities in admin/minibb/index.php in phpBLASTER CMS 1.0 RC1 when register_globals is enabled allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) DB (2) lang and (3) skin parameters.


Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and earlier when register_globals is enabled and magic_quotes_gpc is disabled allows remote attackers to create or read arbitrary files via directory traversal sequences in the edit_file parameter.


Directory traversal vulnerability in index.php in OTManager CMS 24a allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the conteudo parameter. NOTE: in some environments this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp ftps or ssh2.sftp URL.


Directory traversal vulnerability in ap-save.php in Atarone CMS 1.2.0 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the theme_chosen parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer ActiveX control (AdView.dll 9.0.0.96) as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009 allows remote attackers to overwrite arbitrary files via \..\\\ sequences in the argument to the SaveAS method.


Gallery before 1.5.9 and 2.x before 2.2.6 does not properly handle ZIP archives containing symbolic links which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files via vectors related to the archive upload (aka zip upload) functionality.


Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2 Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to bypass \restrictions imposed on local HTML files \ and obtain sensitive information and prompt users to write this information into a file via directory traversal sequences in a resource: URI.


Directory traversal vulnerability in index.php in Fritz Berger yet another php photo album - next generation (yappa-ng) 2.3.2 and possibly other versions through 2.3.3-beta0 when magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the album parameter.


Directory traversal vulnerability in EKINdesigns MySQL Quick Admin 1.5.5 allows remote attackers to read and execute arbitrary files via a .. (dot dot) in the lang parameter to actions.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple directory traversal vulnerabilities in EasySite 2.3 allow remote attackers to read arbitrary files or list directories via a .. (dot dot) in the (1) module or (2) action parameter in (a) www/index.php; the (3) module (4) ss_module or (5) ss_action parameter in (b) modules/Module/index.php or (c) modules/Themes/index.php; or the (6) module parameter in (d) inc/vmenu.php.


Multiple directory traversal vulnerabilities in CCMS 3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin parameter to (1) index.php (2) forums.php (3) admin.php (4) header.php (5) pages/story.php and (6) pages/poll.php.


Directory traversal vulnerability in the web server in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a GET request. NOTE: this can be leveraged with CVE-2008-4874 for unauthenticated access to sensitive files such as (1) save.dat and (2) apply.log which can contain other credentials such as the Skype username and password.


Directory

traversal

vulnerability

in

in

Tribiq

CMS

when

is

enabled

and

is

disabled

allows

remote

attackers

to

include

and

execute

arbitrary

local

files

via

directory

traversal

sequences

in

the

parameter.

NOTE:

it

was

later

reported

that

this

issue

also

affects


Directory traversal vulnerability in the HP JetDirect web administration interface in the HP-ChaiSOE 1.0 embedded web server on the LaserJet 9040mfp LaserJet 9050mfp and Color LaserJet 9500mfp before firmware 08.110.9; LaserJet 4345mfp and 9200C Digital Sender before firmware 09.120.9; Color LaserJet 4730mfp before firmware 46.200.9; LaserJet 2410 LaserJet 2420 and LaserJet 2430 before firmware 20080819 SPCL112A; LaserJet 4250 and LaserJet 4350 before firmware 20080819 SPCL015A; and LaserJet 9040 and LaserJet 9050 before firmware 20080819 SPCL110A allows remote attackers to read arbitrary files via directory traversal sequences in the URI.


Directory traversal vulnerability in templater.php in the ZZ_Templater module in TinyCMS 1.1.2 when register_globals is enabled and magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the configtemplate parameter.


Directory traversal vulnerability in includes/xml.php in the Netenberg Fantastico De Luxe module before 2.10.4 r19 for cPanel when cPanel PHP Register Globals is enabled allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) or absolute pathname in the fantasticopath parameter. NOTE: in some environments this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp ftps or ssh2.sftp URL.


Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier and 2.5 allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details are obtained from third party information.


Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2 Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. (dot dot) and URL-encoded / (slash) characters in a resource: URI.


Unspecified vulnerability in class/theme.class.php in SPAW Editor PHP Edition before 2.0.8.1 has unknown impact and attack vectors probably related to directory traversal sequences in the theme name.


Multiple directory traversal vulnerabilities in PhpWebGallery 1.3.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) userlanguage and (2) usertemplate parameters to (a) init.inc.php and (b) the userlanguage parameter to isadmin.inc.php.


Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated users to configure arbitrary local files for execution via directory traversal sequences in the value of the theme_dir field during a jsoption action related to Sources/QueryString.php and Sources/Themes.php as demonstrated by a local .gif file in attachments/ with PHP code that was uploaded through a profile2 action to index.php.


Multiple directory traversal vulnerabilities in LightBlog 9.8 when magic_quotes_gpc is disabled allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) username parameter to view_member.php (2) username_post parameter to login.php and the (3) Lightblog_username cookie parameter to check_user.php.


Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.01 and 3.01a allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the s parameter to code/commupdate.php in a count action or (2) the heads parameter to code/newsheads.php. NOTE: the blog.php vector is already covered by CVE-2008-3164.


Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. (dot dot) in the package parameter during an install2 action as demonstrated by a predictable package filename in attachments/ that was uploaded through a post2 action to index.php.


Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.


Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla! when magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter.


thumbsup.php in Thumbs-Up 1.12 as used in LightNEasy \no database\ (aka flat) and SQLite 1.2.2 and earlier allows remote attackers to copy rename and read arbitrary files via directory traversal sequences in the image parameter with a modified cache_dir parameter containing a %00 (encoded null byte).


** DISPUTED ** Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a when .htaccess is not supported allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the loader_file parameter. NOTE: the vendor disputes this issue stating \at worst the use of this vulnerability will reveal some local file paths.\


Directory traversal vulnerability in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the scriptpath_show parameter in a GoAhead action. NOTE: this issue only crosses privilege boundaries when security settings such as disable_functions and safe_mode are active since exploitation requires uploading of executable code to a home directory.


Multiple directory traversal vulnerabilities in Private Messaging System (PMS) 1.2.3 and earlier for PunBB allow remote attackers to include and execute arbitrary files via a .. (dot dot) in the pun_userlanguage parameter to (1) functions_navlinks.php (2) header_new_messages.php (3) profile_send.php and (4) viewtopic_PM-link.php in include/pms/.


Multiple directory traversal vulnerabilities in 2532designs 2532|Gigs 1.2.2 Stable when register_globals is enabled and magic_quotes_gpc is disabled allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter to (1) settings.php (2) deleteuser.php (3) mini_calendar.php (4) manage_venues.php and (5) manage_gigs.php a different vector than CVE-2007-4585.


Multiple directory traversal vulnerabilities in SG Real Estate Portal 2.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) mod (2) page or (3) lang parameter to index.php; or the (4) action or (5) folder parameter in a security request to admin/index.php.


Multiple directory traversal vulnerabilities in CMScout 2.06 when register_globals is enabled allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the bit parameter to (1) admin.php and (2) index.php different vectors than CVE-2008-3415.


Multiple directory traversal vulnerabilities in LightNEasy \no database\ (aka flat) version 1.2.2 and possibly SQLite version 1.2.2 allow remote attackers to read arbitrary files via a .. (dot dot) in the page parameter to (1) index.php and (2) LightNEasy.php.


Multiple directory traversal vulnerabilities in XOOPS 2.3.1 when register_globals is enabled allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsConfiglanguage parameter to (1) blocks.php and (2) main.php in xoops_lib/modules/protector/.


Directory traversal vulnerability in the PXE TFTP Service (PXEMTFTP.exe) in LANDesk Management Suite (LDMS) 8.80.1.1 and earlier allows remote attackers to read arbitrary files via a subdirectory name followed by \..\ sequences a different vulnerability than CVE-2008-1643.


Directory traversal vulnerability in _conf/core/common-tpl-vars.php in PHPmyGallery 1.0 beta2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter a different issue than CVE-2008-6316 and a different vector than CVE-2008-6318.


Multiple directory traversal vulnerabilities in the RenderFile function in ContentRender.class.php in Terracotta (aka OpenTerracotta) 0.6.1 and possibly other versions allow remote attackers to list arbitrary directories and read arbitrary files via a .. (dot dot) in the (1) CurrentDirectory and (2) File parameters to index.php.


Directory traversal vulnerability in _conf/_php-core/common-tpl-vars.php in PHPmyGallery 1.5 beta allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the conflang parameter a different issue than CVE-2008-6318. NOTE: this might be the same issue as CVE-2008-6316.


Directory traversal vulnerability in configuration_script.php in MyKtools 3.0 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the langage parameter a different vulnerability than CVE-2008-4781. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple directory traversal vulnerabilities in phpKF-Portal 1.10 allow remote attackers to include arbitrary files via a .. (dot dot) in the (1) tema_dizin parameter to baslik.php and (2) portal_ayarlarportal_dili parameter to anket_yonetim.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in addedit-render.php in phpAddEdit 1.3 when magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files via a URL in the editform parameter. NOTE: PHP remote file inclusion attacks are also likely.


Multiple directory traversal vulnerabilities in moziloCMS 1.10.2 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) file parameter to download.php and the (2) page parameter to index.php a different vector than CVE-2008-3589.


Multiple

directory

traversal

vulnerabilities

in

e-Vision

CMS

and

earlier

when

is

disabled

allow

remote

attackers

to

include

and

execute

arbitrary

local

files

via

a

(dot

dot)

in

an

adminlang

cookie

to

or

the

module

parameter

to

or

in

modules/.


** DISPUTED ** Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a 1.3.8 and earlier when .htaccess is not supported allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _SESSIONlanguage parameter. NOTE: the vendor disputes this issue stating \at worst the use of this vulnerability will reveal some local file paths.\


Directory traversal vulnerability in commsrss.php in fuzzylime (cms) before 3.01b allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a files array element for a blogs action as demonstrated by the files0 parameter.


Directory traversal vulnerability in includes/template-loader.php in Irmin CMS (formerly Pepsi CMS) 0.5 and 0.6 BETA2 when register_globals is enabled allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the _Root_Path parameter. NOTE: some of these details are obtained from third party information.


Multiple directory traversal vulnerabilities in Pligg 9.9 and earlier allow remote attackers to (1) determine the existence of arbitrary files via a .. (dot dot) in the $tb_url variable in trackback.php or (2) include arbitrary files via a .. (dot dot) in the template parameter to settemplate.php.


Multiple

directory

traversal

vulnerabilities

in

ezContents

allow

remote

attackers

to

include

and

execute

arbitrary

local

files

via

the

gsLanguage

and

parameters

to

gsLanguage

and

parameters

to

gsLanguage

and

parameters

to

parameter

to

nLink

gsLanguage

and

parameters

to

and

possibly

other

unspecified

vectors

in

diary/showeventlist.php

gallery/showgallery.php

reviews/showreviews.php

gallery/showgallerydetails.php

reviews/showreviewsdetails.php

news/shownewsdetails.php

diary/inlineeventlist.php

and

in

modules/

related

to

the

lack

of

directory

traversal

protection

in

modules/moduleSec.php.


Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1.4.2 and earlier as used in QSF Portal before 1.4.5 when running on Windows allows remote attackers to include and execute arbitrary local files via a \\\\ (backslash) in the lang parameter to index.php which bypasses a protection mechanism that only checks for \/\ (forward slash) as demonstrated by uploading and including PHP code in an avatar file.


module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include and execute arbitrary local files via \....//\ (doubled dot dot slash) sequences in the link parameter which is not properly filtered using the str_replace function.


Multiple directory traversal vulnerabilities in Unica Affinium Campaign 7.2.1.0.55 allow remote attackers to (1) create arbitrary directories or files via a .. (dot dot) in the folder name in the new folder functionality or (2) list arbitrary files via a crafted request to Campaign/CampaignListener.


Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.3.0 allow remote authenticated users to access arbitrary files and directories via vectors involving a symlink in a pathname to a (1) CWD (2) DELE (3) STOR or (4) RETR command.


Directory traversal vulnerability in classes/imgsize.php in Gelato 0.95 allows remote attackers to read arbitrary files via (1) a .. (dot dot) and possibly (2) a full pathname in the img parameter. NOTE: some of these details are obtained from third party information.


Multiple directory traversal vulnerabilities in Content Management Made Easy (CMME) 1.12 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the env parameter in a weblog action to index.php or (2) create arbitrary directories via a .. (dot dot) in the env parameter in a login action to admin.php.


Multiple directory traversal vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) script_path parameter to (a) options.php and the (2) lang_code parameter to (b) copy_vip.php and (c) process_edit_board.php in adminopts/. NOTE: some of these vectors might not be vulnerabilities under proper installation.


Directory traversal vulnerability in index.php in Neutrino Atomic Edition 0.8.4 allows remote attackers to read and modify files as demonstrated by manipulating data/sess.php in (1) usb and (2) del_pag actions. NOTE: this can be leveraged for code execution by performing an upload that bypasses the intended access restrictions that were implemented in sess.php.


Directory traversal vulnerability in rss.php in fuzzylime (cms) 3.01a and earlier when magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p parameter as demonstrated using content.php a different vector than CVE-2007-4805.


Directory traversal vulnerability in contrib/phpBB2/modules.php in Gallery 1.5.7 and 1.6-alpha3 when register_globals is enabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter within a modload action.


Multiple

directory

traversal

vulnerabilities

in

in

pluck

allow

remote

attackers

to

include

and

execute

arbitrary

local

files

via

a

(dot

dot)

in

the

langpref

file

blogpost

or

cat

parameter.


Multiple

directory

traversal

vulnerabilities

in

Pluck

CMS

on

Windows

allow

remote

attackers

to

include

and

execute

arbitrary

local

files

via

a

(dot

dot

backslash)

in

the

blogpost

cat

and

file

parameters

to

as

reachable

through

index.php;

and

the

blogpost

and

cat

parameters

to

as

reachable

through

index.php.

NOTE:

the

issue

involving

vectors

through

reportedly

exists

because

of

an

incomplete

fix

for


Directory traversal vulnerability in modules/system/admin.php in XOOPS 2.0.18 1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the fct parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in index.php in PHPizabi 0.848b C1 HFP3 allows remote authenticated administrators to read arbitrary files via (1) a .. (dot dot) (2) a URL or possibly (3) a full pathname in the id parameter in an admin.templates.edittemplate action. NOTE: some of these details are obtained from third party information.


Multiple

directory

traversal

vulnerabilities

in

Freeway

when

is

enabled

allow

remote

attackers

to

include

and

execute

arbitrary

local

files

via

a

(dot

dot)

in

the

language

parameter

to

english/account.php

french/account.php

and

in

includes/languages/;

loginbox.php

and

in

templates/Freeway/boxes/;

and

NOTE:

vector

may

be

the

same

as


Directory traversal vulnerability in index.php in (1) WSN Forum 4.1.43 and earlier (2) Gallery 4.1.30 and earlier (3) Knowledge Base (WSNKB) 4.1.36 and earlier (4) Links 4.1.44 and earlier and possibly (5) Classifieds before 4.1.30 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the TID parameter as demonstrated by uploading a .jpg file containing PHP sequences.


Multiple directory traversal vulnerabilities in index.php in Dayfox Blog 4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) p (2) cat and (3) archive parameters. NOTE: in some environments this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp ftps or ssh2.sftp URL.


Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7 JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class aka CR 6703909.


Directory traversal vulnerability in common.php in CMScout 2.05 when .htaccess is not supported allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter as demonstrated by an upload to avatar/ of a .jpg file containing PHP sequences.


Directory

traversal

vulnerability

in

in

Lemon

CMS

allows

remote

attackers

to

include

and

execute

arbitrary

local

files

via

a

(dot

dot)

in

the

dir

parameter.

NOTE:

the

provenance

of

this

information

is

unknown;

the

details

are

obtained

solely

from

third

party

information.

NOTE:

this

might

be

an

issue

in

FCKeditor.


Directory traversal vulnerability in the user_get_profile function in include/functions.inc.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier when the charset is utf-8 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang part of serialized data in an _data cookie.


Directory traversal vulnerability in blog.php in fuzzylime (cms) 3.01 when magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter. NOTE: it was later reported that 3.01a is also affected.


Directory traversal vulnerability in bin/configure in TWiki before 4.2.3 when a certain step in the installation guide is skipped allows remote attackers to read arbitrary files via a query string containing a .. (dot dot) in the image variable and execute arbitrary files via unspecified vectors.


Directory traversal vulnerability in include/head_chat.inc.php in php Help Agent 1.0 and 1.1 Full allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the content parameter. NOTE: in some environments this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp ftps or ssh2.sftp URL.


Multiple directory traversal vulnerabilities in ErfurtWiki R1.02b and earlier when register_globals is enabled allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) ewiki_id and (2) ewiki_action parameters to fragments/css.php and possibly the (3) id parameter to the default URI. NOTE: the default URI is site-specific but often performs an include_once of ewiki.php.


Multiple directory traversal vulnerabilities in index.php in FOG Forum 0.8.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) fog_lang and (2) fog_skin parameters probably related to libs/required/share.inc; and possibly the (3) fog_pseudo (4) fog_posted (5) fog_password and (6) fog_cook parameters.


Directory traversal vulnerability in the UpdateAgent function in TmListen.exe in the OfficeScanNT Listener service in the client in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1372 OfficeScan 8.0 SP1 before build 1222 OfficeScan 8.0 SP1 Patch 1 before build 3087 and Worry-Free Business Security 5.0 before build 1220 allows remote attackers to read arbitrary files via directory traversal sequences in an HTTP request. NOTE: some of these details are obtained from third party information.


Multiple directory traversal vulnerabilities in TinX/cms 1.1 when register_globals is enabled allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) language parameter to (a) include_me.php (b) admin/ajax.php and (c) admin/objects/catalog.ajaxhandler.php; and the (2) prefix parameter to (d) admin/inc/config.php.


Multiple directory traversal vulnerabilities in BitKinex 2.9.3 allow remote FTP and WebDAV servers to create or overwrite arbitrary files via a .. (dot dot) in (1) a response to a LIST command from the BitKinex FTP client and (2) a response to a PROPFIND command from the BitKinex WebDAV client. NOTE: this can be leveraged for code execution by writing to a Startup folder.


Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safe_mode restrictions by creating a subdirectory named http: and then placing ../ (dot dot slash) sequences in an http URL argument to the (1) chdir or (2) ftok function.


Directory traversal vulnerability in the FTP client in ALTools ESTsoft ALFTP 4.1 beta 2 and 5.0 allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a response to a LIST command a related issue to CVE-2002-1345. NOTE: this can be leveraged for code execution by writing to a Startup folder.


Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37 5.5.0 through 5.5.26 and 6.0.0 through 6.0.16 when allowLinking and UTF-8 are enabled allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected but the vendor advisory lists 6.0.16 as the last affected version.


Multiple directory traversal vulnerabilities in HomePH Design 2.10 RC2 when register_globals is enabled allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) thumb_template parameter to (a) admin/templates/template_thumbnail.php and the (2) language parameter to (b) account/account.php (c) downloads/downloads.php (d) forum/forum.php (e) fotogalerie/delete.php and (f) fotogalerie/fotogalerie.php in admin/features/.


Directory traversal vulnerability in GlobalSCAPE CuteFTP Home 8.2.0 Build 02.26.2008.4 and CuteFTP Pro 8.2.0 Build 04.01.2008.1 allows remote FTP servers to create or overwrite arbitrary files via ..\\ (dot dot backslash) sequences in responses to LIST commands a related issue to CVE-2002-1345. NOTE: this can be leveraged for code execution by writing to a Startup folder.


Multiple directory traversal vulnerabilities in Exero CMS 1.0.0 and 1.0.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme parameter to (1) custompage.php (2) errors/404.php (3) members/memberslist.php (4) members/profile.php (5) news/fullview.php (6) news/index.php (7) nopermission.php (8) usercp/avatar.php or (9) usercp/editpassword.php in themes/Default/. NOTE: some of these details are obtained from third party information.


Directory traversal vulnerability in the FireFTP add-on before 0.98.20080518 for Firefox allows remote FTP servers to create or overwrite arbitrary files via ..\\ (dot dot backslash) sequences in responses to (1) MLSD and (2) LIST commands a related issue to CVE-2002-1345. NOTE: this can be leveraged for code execution by writing to a Startup folder.


Directory traversal vulnerability in includes/header.php in Hedgehog-CMS 1.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the c_temp_path parameter. NOTE: in some environments this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp ftps or ssh2.sftp URL.


Apache Tomcat 4.1.0 through 4.1.37 5.5.0 through 5.5.26 and 6.0.0 through 6.0.16 when a RequestDispatcher is used performs path normalization before removing the query string from the URI which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.


Directory traversal vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to include arbitrary local files via directory traversal sequences in the page parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in caloggerd in CA BrightStor ARCServe Backup 11.0 11.1 and 11.5 allows remote attackers to append arbitrary data to arbitrary files via directory traversal sequences in unspecified input fields which are used in log messages. NOTE: this can be leveraged for code execution in many installation environments by writing to a startup file or configuration file.


Directory traversal vulnerability in func.php in Devalcms 1.4a when magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the currentpath parameter in conjunction with certain ... (triple dot) and ..... sequences in the currentfile parameter to index.php.


Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1 when register_globals is enabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601 the vendor patched 3.1 without changing the version number.


Directory traversal vulnerability in the UmxEventCli.CachedAuditDataList.1 (aka UmxEventCliLib) ActiveX control in UmxEventCli.dll in CA Internet Security Suite 2008 allows remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the argument to the SaveToFile method. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: some of these details are obtained from third party information.


Multiple directory traversal vulnerabilities in PHP-Fusion Forum Rank System 6 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the settingslocale parameter to (1) forum.php and (2) profile.php in infusions/rank_system/. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in the posix_access function in PHP 5.2.6 and earlier allows remote attackers to bypass safe_mode restrictions via a .. (dot dot) in an http URL which results in the URL being canonicalized to a local filename after the safe_mode check has successfully run.


Directory traversal vulnerability in Core FTP client 2.1 Build 1565 allows remote FTP servers to create or overwrite arbitrary files via .. (dot dot) sequences in responses to LIST commands a related issue to CVE-2002-1345. NOTE: this can be leveraged for code execution by writing to a Startup folder.


PHP remote file inclusion vulnerability in Chilek Content Management System (aka ChiCoMaS) 2.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter to the default URI under install/. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences.


Multiple directory traversal vulnerabilities in Galatolo WebManager (GWM) 1.0 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in (1) the plugin parameter to admin/plugins.php or (2) the com parameter to index.php.


Multiple PHP remote file inclusion vulnerabilities in Brim (formerly Booby) 1.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the renderer parameter to template.tpl.php in (1) barrel/ (2) barry/ (3) mylook/ (4) oerdec/ (5) penguin/ (6) sidebar/ (7) slashdot/ and (8) text-only/ in templates/. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences.


Directory traversal vulnerability in the FTP client in Glub Tech Secure FTP before 2.5.16 on Windows allows remote FTP servers to create or overwrite arbitrary files via a ..\\ (dot dot backslash) in a response to a LIST command a related issue to CVE-2002-1345.


Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer (2) Freeze Theme (3) Orange Cutout (4) Lonely Maple (5) Endless (6) Classic Theme and (7) Music Theme webpage templates allow remote attackers to include and execute arbitrary files via \..\ sequences in the page parameter. NOTE: this can be leveraged for remote file inclusion when running in some PHP 5 environments.


Multiple directory traversal vulnerabilities in the Zidget/HTTP embedded HTTP server in ExtremeZ-IP File and Print Server 5.1.2x15 and earlier allow remote attackers to read arbitrary (1) gif (2) png (3) jpg (4) xml (5) ico (6) zip and (7) html files via a \..\\\ (dot dot backslash) sequence in the filename.


Multiple

PHP

remote

file

inclusion

vulnerabilities

in

LookStrike

Lan

Manager

allow

remote

attackers

to

execute

arbitrary

PHP

code

via

a

URL

in

the

parameter

to

and

in

modules\\class\\db\\;

and

Match.php

MatchTeam.php

Rule.php

RuleBuilder.php

RulePool.php

RuleSingle.php

RuleTree.php

Tournament.php

TournamentTeam.php

Tree.php

and

TreeSingle.php

in

modules\\class\\tournament\\.

NOTE:

this

can

also

be

leveraged

to

include

and

execute

arbitrary

local

files

via

directory

traversal

sequences.


Multiple directory traversal vulnerabilities in artmedic webdesign weblog 1.0 when magic_quotes_gpc is disabled allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ta parameter to artmedic_index.php reached through index.php; and the (2) date parameter to artmedic_print.php.


Multiple directory traversal vulnerabilities in HTTP File Server (HFS) before 2.2c when account names are used as log filenames allow remote attackers to create arbitrary (1) files and (2) directories via a .. (dot dot) in an account name when requesting the / URI; and (3) append arbitrary data to a file via a .. (dot dot) in an account name when requesting a URI composed of a \/?%0a\ sequence followed by the data.


Directory traversal vulnerability in the WebLaunch.WeblaunchCtl.1 (aka CWebLaunchCtl) ActiveX control in weblaunch.ocx 1.0.0.1 in Gateway Weblaunch allows remote attackers to execute arbitrary programs via a ..\\ (dot dot backslash) in the second argument to the DoWebLaunch method. NOTE: some of these details are obtained from third party information.


Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to parser/parser.php as demonstrated by a filename ending with %00.gif a different vector than CVE-2005-1840.


Multiple directory traversal vulnerabilities in sflog! 0.96 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) permalink or (2) section parameter to index.php possibly involving includes/entries.inc.php and other files included by index.php.


Multiple directory traversal vulnerabilities in Bubbling Library 1.32 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) uri parameter to (a) yui-menu.tpl.php (b) simple.tpl.php and (c) advanced.tpl.php in dispatcher/framework/; and the (2) page parameter to (d) yui-menu.php (e) simple.php and (f) advanced.php in dispatcher/framework/ different vectors than CVE-2008-0521.


Multiple directory traversal vulnerabilities in Nilson's Blogger 0.11 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the permalink parameter in core.php accessed through index.php; and (2) the thispost parameter in comments.php.


Directory traversal vulnerability in SafeNet Sentinel Protection Server 7.4.1.0 and earlier and Sentinel Keys Server 1.0.4.0 and earlier allows remote attackers to read arbitrary files via a ..\\ (dot dot backslash) in the URI. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-6483.


PHP remote file inclusion vulnerability in index.php in NetRisk 1.9.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: this can also be leveraged for local file inclusion using directory traversal sequences.


Directory traversal vulnerability in Mozilla Firefox before 2.0.0.12 Thunderbird before 2.0.0.12 and SeaMonkey before 1.1.8 when using \flat\ addons allows remote attackers to read arbitrary Javascript image and stylesheet files via the chrome: URI scheme as demonstrated by stealing session information from sessionstore.js.


Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2 (2) filter/sessionfilter.py in CherryPy 2.1 and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files and possibly read and write portions of arbitrary files via a crafted session id in a cookie.


Web Wiz RTE_file_browser.asp in as used in Web Wiz Rich Text Editor 4.0 Web Wiz Forums 9.07 and Web Wiz Newspad 1.02 does not require authentication which allows remote attackers to list directories and read files. NOTE: this can be leveraged for listings outside the configured directory tree by exploiting a separate directory traversal vulnerability.


Directory traversal vulnerability in the Shared Folders feature for VMWare ACE 1.0.2 and 2.0.2 Player 1.0.4 and 2.0.2 and Workstation 5.5.4 and 6.0.2 allows guest OS users to read and write arbitrary files on the host OS via a multibyte string that produces a wide character string containing .. (dot dot) sequences which bypasses the protection mechanism as demonstrated using a \%c0%2e%c0%2e\ string.


Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the page parameter to certain PHP scripts under wp-admin/ or (2) the import parameter to wp-admin/admin.php as demonstrated by discovering the full path via a request for the \\..\\..\\wp-config pathname; and allow remote attackers to modify arbitrary files via a .. (dot dot) in the file parameter to wp-admin/templates.php.


Multiple

directory

traversal

vulnerabilities

in

MODx

Content

Management

System

allow

remote

attackers

to

include

and

execute

arbitrary

local

files

via

a

(dot

dot)

in

the

parameter

to

reached

through

index-ajax.php;

and

read

arbitrary

local

files

via

a

(dot

dot)

in

the

file

parameter

to


Directory traversal vulnerability in the mwGetLocalFileName function in http.c in MiniWeb HTTP Server 0.8.19 allows remote attackers to read arbitrary files and list arbitrary directories via a (1) .%2e (partially encoded dot dot) or (2) %2e%2e (encoded dot dot) in the URI.


Multiple directory traversal vulnerabilities in Bubbling Library 1.32 allow remote attackers to read arbitrary files via a .. (dot dot) in the uri parameter to dispatcher.php in (1) examples/dispatcher/framework/ (2) examples/dispatcher/ (3) examples/wizard/ and (4) PHP/ different vectors than CVE-2008-0545.


Directory traversal vulnerability in BitDefender Update Server (http.exe) as used in BitDefender products including Security for Fileservers and Enterprise Manager (BDEM) allows remote attackers to read arbitrary files via .. (dot dot) sequences in an HTTP request.


Directory traversal vulnerability in index.php in SetCMS 3.6.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the set parameter as demonstrated by sending a certain CLIENT_IP HTTP header in an enter action to index.php and injecting PHP sequences into files/enter.set which is then included by index.php.


Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the MOIN_ID user ID in a cookie for a userform action. NOTE: this issue can be leveraged for PHP code execution via the quicklinks parameter.


Multiple directory traversal vulnerabilities in PowerScripts PowerNews 2.5.6 allow remote attackers to read and include arbitrary files via a .. (dot dot) in the (1) subpage parameter in (a) categories.inc.php (b) news.inc.php (c) other.inc.php (d) permissions.inc.php (e) templates.inc.php and (f) users.inc.php in pnadmin/; and (2) the page parameter to (g) pnadmin/index.php. NOTE: vector 2 is only exploitable by administrators.


Multiple

directory

traversal

vulnerabilities

in

Azucar

CMS

allow

remote

attackers

to

include

and

execute

arbitrary

local

files

via

a

(dot

dot)

in

the

(view)

parameter

to

index.php

or


Directory traversal vulnerability in index.php in Sava's Link Manager 2.0 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the q parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple directory traversal vulnerabilities in cpCommerce 1.1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the language parameter in a language action to the default URI which is not properly handled in actions/language.act.php or (2) the action parameter to category.php.


Directory traversal vulnerability in the NeffyLauncher 1.0.5 ActiveX control (NeffyLauncher.dll) in CDNetworks Nefficient Download allows remote attackers to download arbitrary code onto a client system via a .. (dot dot) in the SkinPath parameter and a .zip URL in the HttpSkin parameter. NOTE: this can be leveraged for code execution by writing to a Startup folder.


Directory traversal vulnerability in admin/admin_xs.php in eXtreme Styles module (XS-Mod) 2.3.1 and 2.4.0 for phpBB allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the phpEx parameter. NOTE: some of these details are obtained from third party information.


Directory traversal vulnerability in view_private.php in Keep It Simple Guest Book (KISGB) 5.0.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the tmp_theme parameter. NOTE: 5.1.1 is also reportedly affected.


Directory traversal vulnerability in pb_inc/admincenter/index.php in PowerScripts PowerBook 1.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter. NOTE: in some environments this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp ftps or ssh2.sftp URL.


Multiple directory traversal vulnerabilities in Aterr 0.9.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) class parameter to include/functions.inc.php and the (2) file parameter to include/common.inc.php.


Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows and possibly 8.7 for Mac OS X allows remote attackers to upload files to arbitrary locations via a destination filename with a \\ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.


Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier 1.8.5 before 1.8.5-p231 1.8.6 before 1.8.6-p230 1.8.7 before 1.8.7-p22 and 1.9.0 before 1.9.0-2 when using NTFS or FAT filesystems allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus) (2) %2b (encoded plus) (3) . (dot) (4) %2e (encoded dot) or (5) %20 (encoded space) character in the URI possibly related to the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot option.


Directory traversal vulnerability in index.php in Sava's GuestBook 2.0 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114 and 1.9 through 1.9.0-1 when running on systems that support backslash (\\) path separators or case-insensitive file names allows remote attackers to access arbitrary files via (1) \..%5c\ (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option.


Multiple directory traversal vulnerabilities in CoronaMatrix phpAddressBook 2.11 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin parameter to (1) index.php and (2) install.php. NOTE: it was later reported that vector 1 is also present in 2.0.


Directory traversal vulnerability in modules/threadstop/threadstop.php in ExBB Italia 0.22 and earlier when register_globals is enabled and magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the exbbdefault_lang parameter.


Directory traversal vulnerability in the _serve_request_multiple function in lib/Perlbal/ClientHTTPBase.pm in Perlbal before 1.70 when concat get is enabled allows remote attackers to read arbitrary files in a parent directory via a directory traversal sequence in an unspecified parameter. NOTE: some of these details are obtained from third party information.


Multiple

directory

traversal

vulnerabilities

in

the

Default

theme

in

Exero

CMS

allow

remote

attackers

to

include

and

execute

arbitrary

local

files

via

directory

traversal

sequences

in

the

theme

parameter

to

index.php

editpassword.php

and

avatar.php

in

usercp/;

custompage.php;

memberslist.php

and

profile.php

in

members/;

index.php

and

fullview.php

in

news/;

and

nopermission.php.


plugins/maps/db_handler.php in LinPHA 1.3.3 and earlier does not require authentication for a settings action that modifies the configuration file which allows remote attackers to conduct directory traversal attacks and execute arbitrary local files by placing directory traversal sequences into the maps_type configuration setting and then sending a request to maps_view.php which causes plugins/maps/map.main.class.php to use the modified configuration.


Multiple directory traversal vulnerabilities in PowerPHPBoard 1.00b allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) settingsfooter parameter to footer.inc.php and the (2) settingsheader parameter to header.inc.php.


Multiple directory traversal vulnerabilities in index.php in Uberghey CMS 0.3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) page_id and (2) language parameters. NOTE: this might be the same issue as CVE-2008-1324.


Directory traversal vulnerability in download.html in ARWScripts Gallery Script Lite (aka gallery-script-lite or Free Photo Gallery Site Script) as of 20080411 allows remote attackers to read arbitrary local files via directory traversal sequences in the path parameter.


Multiple directory traversal vulnerabilities in index.php in Travelsized CMS 0.4.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) page_id and (2) language parameters. NOTE: this might be the same issue as CVE-2008-1325.


Directory traversal vulnerability in Horde 3.1.6 Groupware before 1.0.5 and Groupware Webmail Edition before 1.0.6 when running with certain configurations allows remote authenticated users to read and execute arbitrary files via \..\ sequences and a null byte in the theme name.


Multiple directory traversal vulnerabilities in Elastic Path (EP) 4.1 and 4.1.1 allow remote attackers to (1) download arbitrary files via a .. (dot dot) in the file parameter to manager/getImportFileRedirect.jsp (2) upload arbitrary files via a \..\\\ (dot dot backslash) in the file parameter to importData.jsp and (3) list directory contents via a .. (dot dot) in the dir parameter to manager/fileManager.jsp.


Directory traversal vulnerability in utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to overwrite arbitrary files via a .. (dot dot) in the --save argument related to the --session-dir argument a different vulnerability than CVE-2011-1760.


Directory traversal vulnerability in sql.php in phpMyAdmin 3.4.x before 3.4.3.2 when configuration storage is enabled allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a MIME-type transformation parameter.


script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting which might allow remote authenticated users to conduct directory traversal attacks by leveraging a script.


Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the FILENAME parameter. NOTE: this might overlap the US-CERT VU#543310 issue.


Directory

traversal

vulnerability

in

in

phpMyAdmin

before

and

before

when

a

certain

MIME

transformation

feature

is

enabled

allows

remote

authenticated

users

to

include

and

execute

arbitrary

local

files

via

a

(dot

dot)

in

a

GLOBALSmime_map$meta->nametransformation

parameter.


Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field related to (1) libraries/schema/User_Schema.class.php and (2) schema_export.php.


Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2 7.x before 7.1(5b)SU2 and 8.x before 8.0(3) and Cisco Unified Contact Center Express (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response (Unified IP-IVR) before 6.0(1)SR1ES8 7.0(x) before 7.0(2)ES1 8.0(x) through 8.0(2)SU3 and 8.5(x) before 8.5(1)SU2 allows remote attackers to read arbitrary files via a crafted URL aka Bug IDs CSCth09343 and CSCts44049.


Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files and remote attackers to overwrite certain files via a .. (dot dot) in an interface name. NOTE: this can be leveraged with a symlink to overwrite arbitrary files.


Directory traversal vulnerability in pure-FTPd 1.0.22 and possibly other versions when running on SUSE Linux Enterprise Server and possibly other operating systems when the Netware OES remote server feature is enabled allows local users to overwrite arbitrary files via unknown vectors.


Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x (2) the CN in the Subject of a CSR in 2.6 and 0.25.


Directory traversal vulnerability in the web interface in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3 5.5.4 5.5.5 6.0.2 6.1.1 and 6.2.0 allows remote attackers to read arbitrary files via unspecified vectors.


Directory traversal vulnerability in dc.exe 9.00.00.11059 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allows remote attackers to execute arbitrary programs via ..\\ (dot dot backslash) sequences in opcodes (1) 0xa and (2) 0x17 to TCP port 12397.


crontab.c in crontab in FreeBSD allows local users to determine the existence of arbitrary directories via a command-line argument composed of a directory name concatenated with a directory traversal sequence that leads to the /etc/crontab pathname.


Directory

traversal

vulnerability

in

in

QooxDoo

and

possibly

other

versions

as

used

in

eyeOS

and

and

possibly

other

products

allows

remote

attackers

to

read

arbitrary

files

via

(encoded

dot

dot)

sequences

in

the

file

parameter.


Multiple directory traversal vulnerabilities in FocalMedia.Net Quick Polls before 1.0.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the p parameter in a preview action to index.php or (2) delete arbitrary files via a .. (dot dot) in the p parameter in a delete action to index.php.


Directory traversal vulnerability in Cisco Unified Communications Manager (aka CUCM formerly CallManager) 6.x before 6.1(5)su3 7.x before 7.1(5b)su3 8.0 before 8.0(3a)su1 and 8.5 before 8.5(1) allows remote authenticated users to upload files to arbitrary directories via a modified pathname in an upload request aka Bug ID CSCti81603.


Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000.


Directory traversal vulnerability in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allows remote attackers to (1) read (opcode 0x3) or (2) create or write (opcode 0x2) arbitrary files via ..\\ (dot dot backslash) sequences to TCP port 12401.


Directory traversal vulnerability in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00 6.10 and 6.11 allows remote attackers to read arbitrary files via directory traversal sequences in a filename in a GET_FILE message.


Directory traversal vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17 Thunderbird before 3.1.10 and SeaMonkey before 2.0.14 on Windows allows remote attackers to determine the existence of arbitrary files and possibly load resources via vectors involving a resource: URL.


Directory traversal vulnerability in WebSEAL in IBM Tivoli Access Manager for e-business 5.1 before 5.1.0.39-TIV-AWS-IF0040 6.0 before 6.0.0.25-TIV-AWS-IF0026 6.1.0 before 6.1.0.5-TIV-AWS-IF0006 and 6.1.1 before 6.1.1-TIV-AWS-FP0001 has unspecified impact and attack vectors. NOTE: this might overlap CVE-2010-4622.


Multiple directory traversal vulnerabilities in AR Web Content Manager (AWCM) 2.2 allow remote attackers to read arbitrary files and possibly have other unspecified impact via a .. (dot dot) in the (1) awcm_theme or (2) awcm_lang cookie to (a) index.php or (b) header.php.


Directory traversal vulnerability in system/system.php in Zwii 2.1.1 when magic_quotes_gpc is disabled and register_globals is enabled allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the settemplatevalue parameter.


Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr in the web interface.


The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ./.../ sequence in the \extra\ parameter to the help command which causes the regular expression to produce .. (dot dot) sequences. NOTE: this vulnerability is due to an incomplete fix for CVE-2011-0049.


Directory traversal vulnerability in Sybase EAServer 6.x before 6.3 ESD#2 as used in Appeon Replication Server Messaging Edition (RSME) and WorkSpace allows remote attackers to read arbitrary files via \../\\\ (dot dot forward-slash backslash) sequences in a crafted request.


Multiple directory traversal vulnerabilities in (1) languages/Language.php and (2) includes/StubObject.php in MediaWiki 1.8.0 and other versions before 1.16.2 when running on Windows and possibly Novell Netware allow remote attackers to include and execute arbitrary local PHP files via vectors related to a crafted language file and the Language::factory function.


Directory traversal vulnerability in admin/remote.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to read arbitrary files via a ..%2f (encoded dot dot slash) in the type parameter.


Directory traversal vulnerability in handlers/files.xml/files.xml.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to read or delete arbitrary files via a non-initial .. (dot dot) in the file parameter as demonstrated by the /../../wikka.config.php pathname in a download action.


Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1 when the EC2 API and the S3/RegisterImage image-registration method are enabled allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest.


Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1 and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the KohaOpacLanguage cookie to cgi-bin/opac/opac-main.pl related to Output.pm.


Directory traversal vulnerability in Serv-U FTP Server before 11.1.0.5 allows remote authenticated users to read and write arbitrary files and list and create arbitrary directories via a \..:/\ (dot dot colon forward slash) in the (1) list (2) put or (3) get commands.


Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.


Multiple directory traversal vulnerabilities in WHMCompleteSolution (WHMCS) 3.x and 4.x allow remote attackers to read arbitrary files via the templatefile parameter to (1) submitticket.php and (2) downloads.php and (3) the report parameter to admin/reports.php.


Multiple

directory

traversal

vulnerabilities

in

osCommerce

allow

remote

attackers

to

include

and

execute

arbitrary

local

files

via

a

(dot

dot)

in

the

set

or

module

parameter

to

(a)

(b)

or

(c)

the

set

parameter

to

the

module

parameter

to

or

the

filter

parameter

to

or

or

the

template

parameter

to

or


Directory traversal vulnerability in HmiLoad in the runtime loader in Siemens WinCC flexible 2004 2005 2007 and 2008; WinCC V11 (aka TIA portal); the TP OP MP Comfort Panels and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime when Transfer Mode is enabled allows remote attackers to execute read create modify or delete arbitrary files via a .. (dot dot) in a string.


Directory traversal vulnerability in openpam_configure.c in OpenPAM before r478 on FreeBSD 8.1 allows local users to load arbitrary DSOs and gain privileges via a .. (dot dot) in the service_name argument to the pam_start function as demonstrated by a .. in the -c option to kcheckpass.


Directory traversal vulnerability in miniweb.exe in the HMI web server in Siemens WinCC flexible 2004 2005 2007 and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP OP MP Comfort Panels and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to read arbitrary files via a ..%5c (dot dot backslash) in a URI.


The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors a related issue to CVE-2009-1523.


Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to obtain content of arbitrary local files via specially-crafted URL request.


Directory traversal vulnerability in the HP-ChaiSOE/1.0 web server on the HP LaserJet P3015 printer with firmware before 07.080.3 LaserJet 4650 printer with firmware 07.006.0 and LaserJet 2430 printer with firmware 08.113.0_I35128 allows remote attackers to read arbitrary files via unspecified vectors a different vulnerability than CVE-2008-4419.


Directory traversal vulnerability in exportcsv/exportcsv_index.php in Open Business Management (OBM) 2.4.0-rc13 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the module parameter in an export_page action.


Multiple directory traversal vulnerabilities in the BackWPup plugin before 1.4.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the wpabs parameter to (1) app/options-view_log-iframe.php or (2) app/options-runnow-iframe.php.


Directory traversal vulnerability in novelllogmanager/FileDownload in Novell Sentinel Log Manager 1.2.0.1_938 and earlier as used in Novell Sentinel before 7.0.1.0 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the filename parameter.


Directory traversal vulnerability in examples/show_code.php in mPDF 5.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.


Symantec Endpoint Protection Manager prior to 14.3 may be susceptible to a directory traversal attack that could allow a remote actor to determine the size of files in the directory.


Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal.


The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin_conf/download.php file parameter.


In firmware version MS_2.6.9900 of Columbia Weather MicroServer a readouts_rd.php directory traversal issue makes it possible to read any file present on the underlying operating system.


A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal.


The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.


The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page.


The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.


The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page.


In index.php in WonderCMS before 2.4.1 remote attackers can delete arbitrary files via directory traversal.


merchants/index.php in Post Affiliate Pro 2.0.4 and earlier with magic_quotes_gpc disabled allows remote attackers to include arbitrary local files via the md parameter possibly due to a directory traversal vulnerability.


CRLF injection vulnerability in mime.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to conduct directory traversal attacks and read arbitrary files via a %0A sequence followed by a .. (dot dot) in the file parameter.


Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal.


11xiaoli is a simple file server. 11xiaoli is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


serverhuwenhui is a simple http server. serverhuwenhui is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the URL.


desafio is a simple web server. desafio is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url but is limited to accessing only .html files.


yzt is a simple file server. yzt is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


caolilinode is a simple file server. caolilinode is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


looppake is a simple http server. looppake is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


shenliru is a simple file server. shenliru is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


sgqserve is a simple file server. sgqserve is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


serveryaozeyan is a simple HTTP server. serveryaozeyan is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the URL.


wanggoujing123 is a simple webserver. wanggoujing123 is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


serveryztyzt is a simple http server. serveryztyzt is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the URL.


Sencisho is a simple http server for local development. Sencisho is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the URL.


enserver is a simple web server. enserver is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


dylmomo is a simple file server. dylmomo is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


serverwg is a simple http server. serverwg is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the URL.


mfrserver is a simple file server. mfrserver is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


yyooopack is a simple file server. yyooopack is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


serverwzl is a simple http server. serverwzl is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the URL.


quickserver is a simple static file server. quickserver is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


22lixian is a simple file server. 22lixian is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the URL.


serverlyr is a simple http server. serverlyr is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the URL.


peiserver is a static file server. peiserver is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


cypserver is a static file server. cypserver is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


tmock is a static file server. tmock is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


pytservce is a static file server. pytservce is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


liuyaserver is a static file server. liuyaserver is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


wintiwebdev is a static file server. wintiwebdev is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


hcbserver is a static file server. hcbserver is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


serverabc is a static file server. serverabc is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


dcserver is a static file server. dcserver is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


zjjserver is a static file server. zjjserver is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


yttivy is a static file server. yttivy is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


dcdcdcdcdc is a static file server. dcdcdcdcdc is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


serve46 is a static file server. serve46 is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


lessindex is a static file server. lessindex is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


serverxxx is a static file server. serverxxx is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


liyujing is a static file server. liyujing is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


myprolyz is a static file server. myprolyz is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


mfrs is a static file server. mfrs is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


ltt is a static file server. ltt is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


nodeaaaaa is a static file server. nodeaaaaa is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


serverzyy is a static file server. serverzyy is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


qinserve is a static file server. qinserve is vulnerable to a directory traversal issue giving an attacker access to the filesystem by placing \../\ in the url.


GetSimpleCMS-3.3.15 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /GetSimpleCMS-3.3.15/admin/log.php


An issue in the FTP server of Sky File v2.1.0 allows attackers to perform directory traversal via `/null//` path commands.


Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request.


In NCH Quorum v2.03 and earlier an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.


In NCH Quorum v2.03 and earlier an authenticated user can use directory traversal via documentprop?file=/.. for file reading.


In NCH Quorum v2.03 and earlier an authenticated user can use directory traversal via logprop?file=/.. for file reading.


Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal (no customer-specific data is exposed).


Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows ..%2f directory traversal via a rest/json/configdb/download/ URI.


PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ directory.


PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has directory traversal via a direct request for a listing of an image directory such as an assets/ directory.


Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.


A security vulnerability in HPE Intelligent Management Center (iMC) PLAT E0506P09 createFabricAutoCfgFile could be remotely exploited via directory traversal to allow remote arbitrary file modification.


A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be locally exploited to allow directory traversal.


SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal.


Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php form_file_name parameter in a download_form action.


BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks.


Symmetricom

SyncServer

and

devices

allow

Directory

Traversal

via

the

FileName

parameter

to

the

syslog.php.


Symmetricom

SyncServer

and

devices

allow

Directory

Traversal

via

the

FileName

parameter

to

messagelog.php.


Symmetricom

SyncServer

and

devices

allow

Directory

Traversal

via

the

FileName

parameter

to

daemonlog.php.


Symmetricom

SyncServer

and

devices

allow

Directory

Traversal

via

the

FileName

parameter

to

authlog.php.


Symmetricom

SyncServer

and

devices

allow

Directory

Traversal

via

the

FileName

parameter

to

kernlog.php.


Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.3 allows remote authenticated attackers to alter arbitrary files via the 'Customapp' function.


Directory traversal vulnerability in storage_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspecified impact via directory traversal sequences.


Directory traversal vulnerability in iChain Insurance Wallet App for iOS Version 1.3.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors.


Directory traversal vulnerability in 'an' App for iOS Version 3.2.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors.


Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to obtain files without access privileges via the application 'Work Flow'.


Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors.


Directory traversal vulnerability in HOUSE GATE App for iOS 1.7.8 and earlier allows remote attackers to read arbitrary files via unspecified vectors.


Directory traversal vulnerability in 7 Media Web Solutions eduTrac before 1.1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the showmask parameter to installer/overview.php.


Directory traversal vulnerability in SAP CMS and CM Services allows attackers to upload arbitrary files via unspecified vectors.


Directory traversal vulnerability in lib/functions/d-load.php in Horizon Quick Content Management System (QCMS) 4.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the start parameter.


Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter.


Directory traversal vulnerability in wiki.c in didiwiki allows remote attackers to read arbitrary files via the page parameter to api/page/get.


Directory traversal vulnerability in Tattyan HP TOWN before 5_10_1 allows remote attackers to read arbitrary files via a .. (dot dot) in a request.


Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attackers to read arbitrary files via the url_name parameter.


Directory

traversal

vulnerability

in

in

the

Zoho

plugin

in

Pydio

(formerly

AjaXplorer)

before

allows

remote

attackers

to

read

or

delete

arbitrary

files

via

unspecified

vectors.