CVE-2018-12631

Redatam7 formerly Redatam WebServer allows remote attackers to read arbitrary files via /redbin/rpwebutilities.exe/text?LFN=../ directory traversal...

Path traversal

A vulnerability in the process of uploading new application images to Cisco FXOS on the Cisco Firepower 4100 Series Next-Generation Firewall NGFW and Firepower 9300 Security Appliance could allow an authenticated, remote attacker using path traversal techniques to create or overwrite arbitrary...

IPConfigure Orchid VMS 2.0.5 Directory Traversal / Information Disclosure

require 'msf/core' class MetasploitModule 'IPConfigure Orchid VMS %q Orchid Core VMS is vulnerable to a directory traversal attack. This affects Linux and Windows operating systems. This allows a remote, unauthenticated attacker to send crafted GET requests to the application, which results in th...

PublicCMS Path Traversal Vulnerability

PublicCMS is an open source content management system CMS written in Java. A directory traversal vulnerability exists in PublicCMS version 4.0.20180210. An attacker can read arbitrary files with the help of admin/cmsWebFile/list.html?path=... / URL to read arbitrary files...

PublicCMS path traversal vulnerability (CNVD-2018-16529)

PublicCMS is an open source content management system CMS written in Java. A directory traversal vulnerability exists in PublicCMS version 4.0.20180210. An attacker can read arbitrary files with the help of admin/cmsTemplate/content.html?path=... / URL to read arbitrary files...

TP-Link Archer C9 Remote Code Execution (CVE-2017-11519)

An authentication bypass vulnerability exists in TP-Link Archer C9 routers. Successful exploitation of this vulnerability would allow a remote attacker to overwrite arbitrary files on the vulnerable system and potentially execute arbitrary code...

Directory traversal

An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF...

Security Bulletin: A vulnerability in wget affects PowerKVM

Summary PowerKVM is affected by a vulnerability in wget. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2016-4971 DESCRIPTION: GNU wget could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted HTTP redirect message...

Security Bulletin: A vulnerability in pigz affects PowerKVM (CVE-2015-1191)

Summary PowerKVM is affected by a vulnerability in pigz. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2015-1191 DESCRIPTION: pigz could allow a remote attacker to traverse directories on the system, caused by an error in pigz.c. An attacker could send a...

Security Bulletin: IBM Maximo Asset Management could allow a remote attacker to include arbitrary files (CVE-2017-1499 )

Summary IBM Maximo Asset Management could allow a remote attacker to include arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable Web server.. Vulnerability Details CVEID: CVE-2017-1499 DESCRIPTION: IBM Maximo Asset Management could allow a remote attacker t...

Security Bulletin: Multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager (TADDM) Web UI (CVE-2016-8925, CVE-2016-8926, CVE-2016-8927)

Summary Multiple vulnerabilities have been identified in TADDM which could allow a remote attacker obtain information, gain access to system files or gain access to data that is restricted to authorised users. Vulnerability Details CVEID: CVE-2016-8925 DESCRIPTION: IBM Tivoli Application Dependen...

Security Bulletin: Vulnerability in Apache Derby affects IBM Cúram Social Program Management (CVE-2015-1832)

Summary IBM Cúram Social Program Management uses the Apache Derby Library. Apache Derby could allow a remote attacker to obtain sensitive information, caused by a XML external entity XXE error when processing XML data by the XML datatype and XmlVTI. An attacker could exploit this vulnerability to...

Security Bulletin: Open Source Apache PDFBox Vulnerability in IBM eDiscovery Analyzer

Summary Apache PDFBox could allow a remote authenticated attacker to obtain sensitive information, caused by a XML external entity XXE error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of...

Security Bulletin: Vulnerability in Apache PDFBox affects FileNet Content Manager and IBM Content Foundation (CVE-2016-2175)

Summary Security vulnerabilitiy exists in Apache PDFBox that affects IBM FileNet Content Manager and IBM Content Foundation. Vulnerability Details CVEID: CVE-2016-2175 DESCRIPTION: Apache PDFBox could allow a remote authenticated attacker to obtain sensitive information, caused by a XML external...

Security Bulletin: IBM Security Key Lifecycle Manager is affected by Path Traversal vulnerability (CVE-2017-1671)

Summary IBM Security Key Lifecycle Manager could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. Vulnerability Details CVEID: CVE-2017-1671 DESCRIPTION:...

Security Bulletin: Path Traversal affects IBM Security Guardium Database Activity Monitor (CVE-2016-0298)

Summary IBM Security Guardium Database Activity Monitor could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to view arbitrary files on the system. Vulnerability Details CVEID: CVE-2016-0298 DESCRIPTION: IBM Security Guardium...

Security Bulletin: Multiple Security Issues in IBM Tealeaf Customer Experience

Summary IBM Tealeaf Customer Experience contains hard-coded credentials. A remote attacker could exploit this vulnerability to gain access to the system. IBM Tealeaf Customer Experience could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted...

Security Bulletin: Mulitiple security vulnerabilities in Apache CXF affects IBM InfoSphere Master Data Management (CVE-2016-6812 CVE-2016-8739 CVE-2017-5653 CVE-2017-5656 CVE-2017-3156)

Summary IBM Initiate Master Data Service is vulnerable to multiple Apache CXF issues and could allow remote attackers to steal a victim's cookie-based authentication credentials and read arbitrary files on the system. Vulnerability Details CVEID: CVE-2016-6812 DESCRIPTION: Apache CXF is vulnerabl...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to a privilege escalation

Summary IBM InfoSphere Information Server could allow a local user to gain elevated privileges by placing arbitrary files in installation directories. Vulnerability Details CVEID: CVE-2017-1468 DESCRIPTION: IBM InfoSphere Information Server could allow a local user to gain elevated privileges by...

CVE-2018-5755

Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet...