CVE-2017-15895

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager SRM before 1.1.5-6542-4 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

CVE-2017-15894

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager DSM 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

CVE-2017-15894

The CVE-2017-15894 entry affects Synology DiskStation Manager (DSM) via a directory traversal in the SYNO.FileStation.Extract component. Affected versions are DSM 6.0.x prior to 6.0.3-8754-3 and DSM 5.2-5967-6 and earlier. The vulnerability allows remote authenticated users to write arbitrary fil...

CVE-2017-15893

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology File Station before 1.1.1-0099 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

CVE-2017-15895

CVE-2017-15895 affects Synology Router Manager (SRM) 1.1.x, where the directory traversal vulnerability in SYNO.FileStation.Extract allows remote authenticated users to write arbitrary files via the dest_folder_path parameter. Impact expected: potential integrity loss on SRM file writes; no confi...

Node.js third-party modules: [augustine] Static Web Server Directory Traversal via Crafted GET Request

Hi, A crafted GET request can be leveraged to traverse the directory structure of a host using the augustine web server package, and request arbitrary files outside of the specified web root. Module specification Name: augustine Version: 0.2.3 latest release build Verified conditions Test server:...

Schneider Electric Pelco VideoXpert Core Admin Portal Directory Traversal

Summary VideoXpert is a video management solution designed for scalability, fitting the needs surveillance operations of any size. VideoXpert Ultimate can also aggregate other VideoXpert systems, tying multiple video management systems into a single interface. Description Pelco VideoXpert suffers...

Directory traversal

The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated directory traversal vulnerability exploited by issuing a specially crafted request, allowing a remote attacker to read/write arbitrary files. This can be exploited via ../ sequences in the pathna...

CVE-2017-16929

The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated directory traversal vulnerability exploited by issuing a specially crafted request, allowing a remote attacker to read/write arbitrary files. This can be exploited via ../ sequences in the pathna...

CVE-2017-12079

Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain arbitrary files via progid field...

CVE-2017-12079

Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain arbitrary files via progid field...

CVE-2017-12079

Synology Photo Station is affected by CVE-2017-12079. The vulnerability exists in the picasa.php file and allows remote attackers to obtain arbitrary files via the prog_id parameter. Affected versions are Photo Station prior to 6.8.1-3458 and prior to 6.3-2970. This is a remote, unauthenticated i...

CVE-2017-14949

Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities not parameter external entities are properly considered. This is related to XmlRepresentation, DOMRepresentatio...

Xml Entity Injection Vulnerability in Carrier System of ZTE Softtronics Co.

ZTE SoftTronics has built a customer-centered business model of "productized software + professional services" to become an outstanding software and service provider. An xml entity injection vulnerability exists in the operator system of ZTE Softtronics Corporation, which can be exploited by an...

Updated perl-Catalyst-Plugin-Static-Simple package fixes security vulnerability

The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character CVE-2017-16248...

Directory traversal

Directory traversal vulnerability in QND Advance/Standard allows an attacker to read arbitrary files via a specially crafted command...

CVE-2017-10861

Directory traversal vulnerability in QND Advance/Standard allows an attacker to read arbitrary files via a specially crafted command...

CVE-2017-10861

Directory traversal vulnerability in QND Advance/Standard allows an attacker to read arbitrary files via a specially crafted command...

CVE-2017-10861

The CVE-2017-10861 issue affects QND Advance/Standard from QualitySoft Japan. A directory traversal vulnerability exists in the administrative server due to how input from an agent program is processed (CWE-22). If a specially crafted command is processed, an attacker can obtain or modify arbitra...

XML External Entity (XXE)

Adobe xmpcore is vulnerable to XML external entity XXE attacks. The attacks are possible because it does not properly handle the XML data containing an external entity declaration in conjunction with an entity reference, allowing users to read arbitrary files...