Login Request a demo
Unscored severity · published Nov 18, 2006
CVE-2006-5971
Absolute path traversal vulnerability in admin/logfile.txt in Verity Ultraseek before 5.6.2 allows remote attackers to read arbitrary files via the name variable
–
CVSS
1.8%
EPSS
No
On KEV
Description
Absolute path traversal vulnerability in admin/logfile.txt in Verity Ultraseek before 5.6.2 allows remote attackers to read arbitrary files via the name variable.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UL
Ultraseek · Verity
through 5.6.2 · source: NVD
Affected product
UL
Ultraseek
Verity
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-5971
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-5971
Vendor Advisory
http://secunia.com/advisories/22892
www.osvdb.org
http://www.osvdb.org/30289
www.securityfocus.com
http://www.securityfocus.com/archive/1/451847/100/0/threaded
www.ultraseek.com
http://www.ultraseek.com/support/docs/RELNOTES.txt
www.ultraseek.com
http://www.ultraseek.com/support/docs/release_notes/ultraseek.5.6.2.txt
www.zerodayinitiative.com
http://www.zerodayinitiative.com/advisories/ZDI-06-042.html
More from Ultraseek
–
CVE-2006-5819
Verity Ultraseek before 5.7 allows remote attackers to use the server as a proxy for web attacks and host scanning via a direct request to the highlight/index.html script
–
CVE-2006-5970
Verity Ultraseek before 5.7 allows remote attackers to obtain sensitive information via direct requests with (1) a null ("%00") terminated url parameter to help/urlstatusgo.html;…
–
CVE-2004-0050
Verity Ultraseek before 5.2.2 allows remote attackers to obtain the full pathname of the document root via an MS-DOS device name in the web search option, such as (1) NUL, (2)…