CVE-2015-0296

The pre-install script in texlive 3.1.20140525r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226r32488.fc20 and rpm allows local users to delete arbitrary files via a crafted file in the user's home directory...

CVE-2015-1429

Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitrary files via a .. dot dot in an unspecified parameter...

CVE-2017-14868

Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension...

The vulnerability of the Arbor Peakflow SP traffic control analysis system lies in the lack of protection for operational data, allowing intruders to read arbitrary files.

The vulnerability of the Arbor Peakflow SP traffic control analysis system is related to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor to read arbitrary files...

Code injection

Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathnames in the s parameter to index.php, related to Lib/Admin/Action/TplAction.class.php and Lib/Admin/Common/function.php...

CVE-2017-14979

Gxlcms (enterprise website creation system) is affected by CVE-2017-14979. The vulnerability arises from an unsafe character-replacement method intended to restrict access, enabling remote attackers to read arbitrary files by altering the s parameter in index.php. Affected components include Lib/...

IBM WebSphere Portal (swg22008586)

The version of IBM WebSphere Portal installed on the remote host is vulnerable to a path traversal vulnerability that could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing 'dot dot' sequences /../ to view arbitrary...

Directory traversal

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to delete arbitrary files via servlet directory traversal...

Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution

Description: The remote code execution is a combination of 4 different vulnerabilities: CVE-2017-11151 allows remote attackers to upload arbitrary files to the specified directories. CVE-2017-11152 allows remote attackers to log in with a fake authentication mechanism. CVE-2017-11153 allows remot...

CVE-2017-1577

IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 132117...

CVE-2015-8249

The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter...

Authorization

The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter...

Xxe

Multiple XML external entity XXE vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a 1 crafted DT...

IBM WebSphere Portal Directory Traversal Vulnerability

IBM WebSphere Portal is a suite of enterprise portal software from IBM. The software creates a platform that connects an organization internally and externally, allowing employees, customers and suppliers to access internal data through the platform. A directory traversal vulnerability exists in...

CVE-2017-14526

Multiple XML external entity XXE vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a 1 crafted DT...

CVE-2015-8249

CVE-2015-8249 is a vulnerability in ManageEngine Desktop Central 9 where the FileUploadServlet accepts user-controlled ConnectionId and allows uploading and executing arbitrary files. The issue occurs in builds prior to 91093 and can lead to remote code execution (context: SYSTEM) via crafted upl...

FLIR Systems FLIR Thermal Camera F/FC/PT/D Multiple Information Disclosures Vulnerability

FLIP Systems thermal cameras have an issues where Input passed through several parameters is not properly verified before being used to read files. This can be exploited by an unauthenticated attacker to read arbitrary files from local resources. FLIR Systems FLIR Thermal Camera F/FC/PT/D Multipl...

WordPress Customizer Component Path Traversal Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Customizer component is one of the components of the build tool for WordPress theme development and plugin development. A...

CVE-2017-8012

In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R Watch4Net for SAS Solution Packs, the Java Management Extensions JMX protocol used to communicate between components in the Alerting and/or Compliance components can be leveraged to create a denial of service DoS condition. Attackers with knowledge o...

Denial of Service Vulnerability in Multiple EMC Products

EMC ViPR SRM and others are products of EMC Corporation.EMC ViPR SRM is a set of storage resource management software.VNX M&R is a set of storage system management solutions. A security vulnerability exists in several EMC products. An attacker could exploit the vulnerability to create arbitrary...