CVE-2018-17246

CVE-2018-17246 affects Kibana prior to 6.4.3 and 5.6.13, due to an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a crafted request that attempts to execute JavaScript, potentially leading to arbitrary commands executed with the K...

PT-2018-13966

Name of the Vulnerable Software and Affected Versions Kibana versions prior to 6.4.3 Kibana versions prior to 5.6.13 Description The issue is related to an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request to execute...

CVE-2018-17246: External Control of File Name or Path

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with...

kibana: Arbitrary file inclusion vulnerability in the Console plugin

Kibana, before 6.4.3 and 5.6.13, contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript code. This could possibly lead to an attacker executing arbitrary commands with permissio...

Arbitrary File Inclusion

kibana is vulnerable to arbitrary file inclusion attacks. The vulnerability exists through the Kibana Console API where a request can be sent to include external JS files which could possibly result in executing arbitrary commands...

Kibana ESA-2018-18

Nethanel Coppenhagen of CyberArk Labs discovered Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to...

CVE-2018-17984

An unanchored /a-z2/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploitable by authenticated users who have local filesystem access...

PT-2018-14314

Name of the Vulnerable Software and Affected Versions ISPConfig versions prior to 3.1.13 Description The issue is related to an unanchored regular expression in the software, which allows authenticated users with local filesystem access to include arbitrary files. This can lead to code execution...

CVE-2018-17984: Incorrect Regular Expression

An unanchored /a-z2/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploitable by authenticated users who have local filesystem access...

CVE-2018-12613: Improper Authentication

An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include view and potentially execute files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An...

Security Bulletin:Multiple vulnerabilities in the IBM Emptoris Services Procurement product

Summary The security bulletin includes multiple vulnerabilities found and addressed in the IBM Emptoris Services Procurement product. Vulnerability Details CVEID: CVE-2017-1440 DESCRIPTION: IBM Emptoris Services Procurement could allow a remote attacker to include arbitrary files. A remote attack...

CVE-2017-1499

IBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to include arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable Web server. IBM X-Force ID: 129106...

PT-2018-5750

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management versions 7.5 through 7.6 Description: The issue allows a remote attacker to include arbitrary files, potentially enabling the execution of arbitrary code on the vulnerable Web server. Recommendations: For IBM Maxim...

CubeCart < 3.0.12 - Multiple Vulnerabilities

Exploit for php platform in category web applications CubeCart Multiple Vulnerabilities Vendor: Devellion Limited Product: CubeCart Version: = 3.0.12 Website: http://www.cubecart.com BID: 19782 CVE: CVE-2006-4525 OSVDB: 28279 28280 28281 SECUNIA: 21659 Description: CubeCart is a very popular web...

WordPress Easy2Map plugin path traversal vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language, the platform supports in PHP and MySQL server set up a personal blog site. easy2Map is one of the support to create a customized Google Maps plugin. A path traversal vulnerability exists in...

CVE-2017-1440

IBM Emptoris Services Procurement 10.0.0.5 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable Web server. IBM...

CVE-2017-1440: Improper Control of Generation of Code

IBM Emptoris Services Procurement 10.0.0.5 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable Web server. IBM...

PT-2017-13443

Name of the Vulnerable Software and Affected Versions IBM Emptoris Services Procurement version 10.0.0.5 Description The issue allows a remote attacker to include arbitrary files by sending a specially-crafted URL, potentially leading to the execution of arbitrary code on the vulnerable web serve...

CVE-2017-1000029

Oracle, GlassFish Server Open Source Edition 3.0.1 build 22 is vulnerable to Local File Inclusion vulnerability, that makes it possible to include arbitrary files on the server, this vulnerability can be exploited without any prior authentication...

PT-2017-10281

Name of the Vulnerable Software and Affected Versions IBM Predictive Solutions Foundation formerly PMQ affected versions not specified Description The issue allows a remote attacker to include arbitrary files by sending a specially-crafted URL to specify a file from the local system. This could...