9.3

CVE-2005-2619

Directory traversal vulnerability in kvarcve.dll in Autonomy (formerly Verity) KeyView SDK before 9.2.0, as used in Lotus Notes 6.5.4 and 7.0, allows remote attackers to delete arbitrary files via a (1) ZIP, (2) UUE or (3) TAR archive that contains a .. (dot dot) in the filename, which is not properly handled when generating a preview.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Lotus Notes Version6.0.1
Ibm ≫ Lotus Notes Version6.0.2
Ibm ≫ Lotus Notes Version6.0.3
Ibm ≫ Lotus Notes Version6.0.4
Ibm ≫ Lotus Notes Version6.0.5
Ibm ≫ Lotus Notes Version6.5
Ibm ≫ Lotus Notes Version6.5.1
Ibm ≫ Lotus Notes Version6.5.2
Ibm ≫ Lotus Notes Version6.5.3
Ibm ≫ Lotus Notes Version6.5.4
Ibm ≫ Lotus Notes Version7.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.29% 0.869
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

http://secunia.com/advisories/16100
Patch
Vendor Advisory
http://secunia.com/advisories/16280
Patch
Vendor Advisory
http://secunia.com/secunia_research/2005-66/advisory/
Vendor Advisory
http://securitytracker.com/id?1015657
Patch
http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229918
Patch
http://www.osvdb.org/23066
Patch
http://www.securityfocus.com/bid/16576
http://www.vupen.com/english/advisories/2006/0500
http://secunia.com/secunia_research/2005-30/advisory/
Vendor Advisory
http://www.securityfocus.com/archive/1/424717/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/24637