FreeBSD : libarchive -- multiple vulnerabilities (7c63775e-be31-11e5-b5fe-002590263bf5)

MITRE reports : Integer signedness error in the archivewritezipdata function in archivewritesetformatzip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service crash via unspecified vectors, which triggers an improper...

CVE-2015-4703

Absolute path traversal vulnerability in mysqldumpdownload.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the dumpfname parameter...

CVE-2015-4703

CVE-2015-4703 describes an absolute path traversal in the WordPress Rename plugin (version 1.0) for WordPress. The vulnerability resides in mysqldump_download.php, where an attacker can read arbitrary files by supplying a full pathname in the dumpfname parameter. This affects the plugin as instal...

CVE-2015-2875

CVE-2015-2875 describes an absolute path traversal in Seagate/LaCie wireless storage firmware prior to 3.4.1.105. A remote attacker with wireless access could read arbitrary files by supplying a full pathname in a download request during a Wi‑Fi session. Affected devices include: Seagate GoFlex S...

CVE-2015-7250

Affected devices: ZTE ZXHN H108N R1A and ZXV10 W300 routers. Vulnerability: CVE-2015-7250 — absolute path traversal in the webproc CGI module (cgi-bin/webproc) allows remote attackers to read arbitrary files via an unvalidated full pathname supplied to the getpage parameter. Root cause: unrestric...

CVE-2015-7683: Absolute Path Traversal in the Font WordPress Plugin

Details ================ Software: Font Version: 7.5 Homepage: https://wordpress.org/plugins/font/ CVE: CVE-2015-7683 Pending CVSS: 6.3 Medium; AV:N/AC:M/Au:S/C:C/I:N/A:N CWE: CWE-22 Description ================ An absolute path traversal vulnerability in Font 7.5 allows WordPress admins read...

VulnCheck KEV: CVE-2015-5065

Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl parameter...

WordPress Font Plugin <= 7.5.0 - Absolute Path Traversal

This vulnerability allows the administrators to read arbitrary files via a full pathname in the "URL" parameter to AjaxProxy.php. Solution Update the plugin...

Gentoo Security Advisory GLSA 201411-05

Gentoo Linux Local Security Checks GLSA 201411-05 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise Absolute Path Traversal Vulnerability

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise are both products of General Electric Company GE, U.S.A. GE Digital Energy MDS PulseNET is a suite of software applications for monitoring and controlling industrial communication network devices. Enterprise is an enterprise version of MD...

CVE-2015-6459

CVE-2015-6459 covers an absolute path traversal in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise FileDownloadServlet prior to version 3.1.5. The vulnerability arises from insufficient validation in the download function, allowing remote attackers to read or delete arbitrary files via...

CVE-2015-5472

CVE-2015-5472 affects the WordPress IBS Mappro plugin (prior to version 1.0). A flaw in lib/download.php allows an attacker to perform absolute path traversal by supplying a full pathname in the file parameter, enabling reading of arbitrary files on the server. The vulnerability is confirmed acro...

SiteFactory CMS Absolute Path Traversal Vulnerability

Mindbite SiteFactory CMS is a content management system CMS developed by Mindbite Switzerland. An absolute path traversal vulnerability exists in Mindbite SiteFactory CMS version 5.5.9, which can be exploited by remote attackers to read arbitrary files...

CVE-2015-6914

CVE-2015-6914 affects Mindbite SiteFactory CMS 5.5.9. The vulnerability is an absolute path traversal in the assets/download.aspx endpoint, where a full pathname supplied in the file parameter allows remote attackers to read arbitrary files on the server. The entry cites a CVSSv2 base score of 7....

Amazon Linux: Security Advisory (ALAS-2014-442)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress IBS Mappro Plugin <= 0.9 - Absolute Path Traversal

This vulnerability is in lib/download.php. It allows an attacker to read arbitrary files via a full pathname in the "file" parameter. Solution Update the plugin...

WordPress Swim Team Plugin <= 1.44.10777 - Absolute Path Traversal

This vulnerability is in include/user/download.php. It allows an attacker to read arbitrary files via a full pathname in the "file" parameter. Solution Update the plugin...

CVE-2014-1836

ImpressCMS 1.3.5 and earlier contain an absolute path traversal in htdocs/libraries/image-editor/image-edit.php via the image_path parameter in a cancel action, enabling remote attackers to delete arbitrary files. This is associated with CVE-2014-1836 and is documented in multiple advisories (GHS...

WordPress Plugin Paypal Currency Converter Basic For WooCommerce Absolute Path Traversal Vulnerability

WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on PHP and MySQL servers.Paypal Currency Converter Basic For WooCommerce is one of the plugins that supports using Paypal payments in the WooCommerc...

CVE-2015-5065

Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl parameter...