CVE-2017-11457

XML external entity XXE vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request, aka SAP Security Note 2387249...

Command injection

SAP TREX 7.10 allows remote attackers to 1 read arbitrary files via an fget command or 2 write to arbitrary files and consequently execute arbitrary code via an fdir command, aka SAP Security Note 2419592...

Server side request forgery (ssrf)

XML external entity XXE vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request, aka SAP Security Note 2387249...

Design/Logic Flaw

The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack...

CVE-2015-3149

The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack...

Path traversal

Absolute path traversal vulnerability in the filemanager component of eFront CMS before 3.6.15.5 allows remote authenticated users to read arbitrary files via a full pathname in the "Upload file from url" field in the file manager for professor.php...

CVE-2015-3149

The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack...

CVE-2015-3149

The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack...

CVE-2017-11459

SAP TREX 7.10 allows remote attackers to 1 read arbitrary files via an fget command or 2 write to arbitrary files and consequently execute arbitrary code via an fdir command, aka SAP Security Note 2419592...

CVE-2017-11459

CVE-2017-11459 affects SAP TREX 7.10. The vulnerability allows remote attackers to read arbitrary files via the fget command and to write arbitrary files to potentially execute arbitrary code via the fdir command, per SAP Security Note 2419592. Root cause labeled as Missing Authentication for Cri...

CVE-2017-11457

XML external entity XXE vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request, aka SAP Security Note 2387249...

XML External Entity (XXE)

Moodle is vulnerable to XML external entity XXE attacks. A malicious user can pass an XML file to the application through a LTI server to cause an XXE attack, allowing the user to read arbitrary files...

Tilde CMS Path Traversal Vulnerability

Tilde CMS is a web content management system CMS. A path traversal vulnerability exists in Tilde CMS version 1.0.1. An attacker can exploit this vulnerability by sending a 'file' parameter file to actionphp/download.File.php with a '. /' to actionphp/download.File.php with the 'file' parameter...

CVE-2015-7703

CVE-2015-7703: ntpd remote configuration feature exposes a file overwrite risk via the :config command when remote configuration is enabled and the attacker knows the configuration password. Affected: ntpd 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77. Connected documents confirm this as a real vu...

Code injection

An issue was discovered in Tilde CMS 1.0.1. Arbitrary files can be read via a file=../ attack on actionphp/download.File.php...

CVE-2017-11325

An issue was discovered in Tilde CMS 1.0.1. Arbitrary files can be read via a file=../ attack on actionphp/download.File.php...

CVE-2017-11325

An issue was discovered in Tilde CMS 1.0.1. Arbitrary files can be read via a file=../ attack on actionphp/download.File.php...

Design/Logic Flaw

Technicolor DPC3928AD DOCSIS devices allow remote attackers to read arbitrary files via a request starting with "GET /../" on TCP port 4321...

Tilde CMS 1.01 - Multiple Vulnerabilities

Tilde CMS 1.01 - Multiple Vulnerabilities Exploit Title: Tilde CMS 1.01 Multiple Vulnerabilities Date: July 7th, 2017 Exploit Authors: Paolo Forte, Raffaele Forte Vendor Homepage: http://www.tildenetwork.com/ Version: Tilde CMS 1.0.1 Tested on: Ubuntu 12.04, PHP 5.3.10 I. INTRODUCTION...

Tilde CMS 1.01 - Multiple Vulnerabilities

Exploit Title: Tilde CMS 1.01 Multiple Vulnerabilities Date: July 7th, 2017 Exploit Authors: Paolo Forte, Raffaele Forte Vendor Homepage: http://www.tildenetwork.com/ Version: Tilde CMS 1.0.1 Tested on: Ubuntu 12.04, PHP 5.3.10 I. INTRODUCTION...