CVE-2017-16651

CVE-2017-16651 - Roundcube Webmail file disclosure : Authenticated users can read arbitrary files on the host filesystem via the file-based attachment plugin workflow (_task=settings&_action=upload-display&_from=timezone). Affected versions include Roundcube before 1.1.10, 1.2.x before 1.2.7, and...

CVE-2017-16651

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host’s filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid...

roundcube -- file disclosure vulnerability

MITRE reports: Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target syst...

SUSE SLES11 Security Update : apache2 (SUSE-SU-2017:2907-1) (Optionsbleed)

This update for apache2 fixes the following issues : - Allow disabling SNI on proxy connections using 'SetEnv proxy-disable-sni 1' in the configuration files. bsc1052830 - Allow ECDH again in modssl, it had been incorrectly disabled with the 2.2.34 update. bsc1064561 Following security issue has...

ZTE ZXR10 1800-2S Path Traversal Vulnerability

The ZTE ZXR10 1800-2S is a router from China's ZTE Corporation ZTE. A security vulnerability exists in the ZTE ZXR10 1800-2S prior to version 3.00.40, which originates from the program failing to properly restrict unauthorized users' access to resources. The vulnerability can be exploited by an...

ZTE ZXR10 1800-2S Improper Access Control Vulnerability

The ZTE ZXR10 1800-2S is a router from ZTE. The ZTE ZXR10 1800-2S fails to properly restrict the range of file download directories for web users, allowing remote attackers to exploit the vulnerability by submitting special requests to download configuration files and steal sensitive information...

Design/Logic Flaw

The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being able to download configuration files to steal information like administrator accounts and passwords...

CVE-2017-10930

The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being able to download configuration files to steal information like administrator accounts and passwords...

CVE-2017-10930

The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being able to download configuration files to steal information like administrator accounts and passwords...

CVE-2017-10930

The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being able to download configuration files to steal information like administrator accounts and passwords...

CVE-2017-10930

The ZXR10 1800-2S router (firmware before 3.00.40) has an access-control flaw that lets unauthorized users download configuration files containing admin usernames and passwords. Multiple sources confirm that ordinary users can bypass restrictions, even via manipulated cookies or requests, to retr...

Arbitrary File Download Vulnerability in SpecialUnit_ExportDown Page of ECOSYS Employment Information Management System

ECOS Employment Information Management System EIMS is an intelligent perceptive environment and comprehensive information service platform that provides personalized and customized services for teachers and students. An arbitrary file download vulnerability exists in the SpecialUnitExportDown pag...

[SECURITY] Fedora 25 Update: augeas-1.8.1-1.fc25

A library for programmatically editing configuration files. Augeas parses configuration files into a tree structure, which it exposes through its public API. Changes made through the API are written back to the initially read files. The transformation works very hard to preserve comments and...

YaST2 network file read vulnerability

Novell YaST Yet another Setup Tool is a set of RPM-based installation and configuration tools for the openSUSE and SUSE Linux Enterprise operating systems from the U.S. company Novell. The tool can configure the system hardware, network, services, etc. YaST2 network is one of the packages to mana...

SeaWell Networks Spectrum SDC Improper Authorization Vulnerability

SeaWell Networks Spectrum SDC is a video solution. The solution utilizes ABR repackaging technology to simplify IP video delivery using a common format. A security vulnerability exists in SeaWell Networks Spectrum SDC version 02.05.00. A remote attacker could exploit the vulnerability to perform...

[SECURITY] Fedora 26 Update: augeas-1.8.1-1.fc26

A library for programmatically editing configuration files. Augeas parses configuration files into a tree structure, which it exposes through its public API. Changes made through the API are written back to the initially read files. The transformation works very hard to preserve comments and...

openldap security update

CentOS Errata and Security Advisory CESA-2017:1852 An update for openldap is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Cisco Elastic Services Controller Information Disclosure Vulnerability (CNVD-2017-221013)

Cisco Elastic Services Controller ESC is an open source modular system from Cisco USA. An information disclosure vulnerability exists in Cisco ESC version 2.32, which arises from the program's failure to adequately protect sensitive data. A remote attacker could exploit the vulnerability to brows...

CVE-2017-6774

A vulnerability in Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to overwrite or modify sensitive system files. The vulnerability is due to the inclusion of sensitive system files within specific FTP...

Information disclosure

A vulnerability in Cisco Elastic Services Controller ESC could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to insufficient protection of sensitive data. An attacker could exploit this vulnerability by authenticating to the application and...