CVE-2012-0315

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Untrusted search path vulnerability in ALFTP before 5.31 allows local users to gain privileges via a Trojan horse executable file in a directory that is accessed for reading an extensionless file, as demonstrated by executing the README.exe file when a user attempts to access the README file.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN85695061/995223/index.htmlThird Party Advisory, VDB Entry
http://jvn.jp/en/jp/JVN85695061/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/jvndb/JVNDB-2012-000011Third Party Advisory, VDB Entry
http://www.altools.jp/ETC/NEWS.aspx?mid=231&vidx=118Broken Link
http://www.altools.jp/download.aspxBroken Link, Patch
http://jvn.jp/en/jp/JVN85695061/995223/index.htmlThird Party Advisory, VDB Entry
http://jvn.jp/en/jp/JVN85695061/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/jvndb/JVNDB-2012-000011Third Party Advisory, VDB Entry
http://www.altools.jp/ETC/NEWS.aspx?mid=231&vidx=118Broken Link
http://www.altools.jp/download.aspxBroken Link, Patch

Timeline

Published: Feb 22, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-03165.0The Cookpad 1.5.16 and earlier and Cookpad Noseru 1.1.1 and earlier applications for Android do not properly implement the WebView class, wh CVE-2012-03176.8Multiple cross-site request forgery (CSRF) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote CVE-2012-03184.3Multiple cross-site scripting (XSS) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attacke CVE-2012-03196.5The file-management system in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote authenticated users to execute CVE-2012-03207.5Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote attackers to take control of sessions via unspecified vectors CVE-2012-03212.1Unspecified vulnerability in the device driver in Kingsoft Internet Security 2011 allows local users to cause a denial of service via a craf CVE-2012-03224.3The EStrongs ES File Explorer application 1.6.0.2 through 1.6.1.1 for Android does not properly restrict access, which allows remote attacke CVE-2012-03234.3Cross-site scripting (XSS) vulnerability in the Autocomplete plugin before 3.0 for SquirrelMail allows remote attackers to inject arbitrary CVE-2012-03244.3Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.CVE-2012-03254.3Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.CVE-2012-03265.0The twicca application 0.7.0 through 0.9.30 for Android does not properly restrict the use of network privileges, which allows remote attack CVE-2012-03274.3Cross-site scripting (XSS) vulnerability in Redmine before 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecif