CVE-2016-10039: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/getfiles...

Arbitrary File Deletion Vulnerability in dir Parameter of Mixcall Seat Management System

Mixcall seat management system is based on B/S architecture, the management personnel can directly log into the Mixcall seat management center through the computer, and view the detailed situation related to the seat personnel's voice services. An arbitrary file deletion vulnerability exists in t...

CVE-2015-6500: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in ownCloud Server before 8.0.6 and 8.1.x before 8.1.1 allows remote authenticated users to list directory contents and possibly cause a denial of service CPU consumption via a .. dot dot in the dir parameter to index.php/apps/files/ajax/scan.php...

PT-2015-2581

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 8.0.6 ownCloud Server versions 8.1.x prior to 8.1.1 Description The issue allows remote authenticated users to list directory contents and possibly cause a denial of service via a .. dot dot in the dir paramet...

PT-2015-6586

Name of the Vulnerable Software and Affected Versions pimcore versions prior to build 3473 Description The issue allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. dot dot in the dir parameter to "admin/asset/add-asset-compatibility"...

CVE-2014-9566: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor NPM before 11.5, NetFlow Traffic Analyzer NTA before 4.1, Network Configuration Manager NCM before 7.3.2, IP...

CVE-2014-9089

Multiple SQL injection vulnerabilities in viewallbugpage.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL commands via the 1 sort or 2 dir parameter to viewallset.php...

CVE-2014-9089

Multiple SQL injection vulnerabilities in viewallbugpage.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL commands via the 1 sort or 2 dir parameter to viewallset.php...

CVE-2014-9095: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the 1 sort or 2 dir parameter to license/records...

Luckybot 3 DIR Parameter Multiple Remote File Include Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/21765/info Multiple remote file-include vulnerabilities affect Luckybot because the application fails to properly sanitize user-supplied input before using it in a PHP 'include' function call. An attacker may leverage the...

cPanel 5/6/7/8/9 dir Parameter Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9853/info It has been reported that cPanel may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser. The issue presents itself due to...

UBUNTU-CVE-2013-2041

Multiple cross-site scripting XSS vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tag parameter to apps/bookmarks/ajax/addBookmark.php or 2 dir parameter to apps/files/ajax/newfile.php, which is passed to...

CVE-2013-2041

Multiple cross-site scripting XSS vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tag parameter to apps/bookmarks/ajax/addBookmark.php or 2 dir parameter to apps/files/ajax/newfile.php, which is passed to...

CVE-2013-2041

Multiple cross-site scripting XSS vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tag parameter to apps/bookmarks/ajax/addBookmark.php or 2 dir parameter to apps/files/ajax/newfile.php, which is passed to...

CVE-2013-2085

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

PT-2014-2545

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.6 Description The issue allows remote authenticated users to access arbitrary files. This is achieved by utilizing a .. dot dot in the dir parameter of the apps/files trashbin/index.php file, which enables...

PT-2013-5724

Name of the Vulnerable Software and Affected Versions AjaXplorer versions 5.0.2 and earlier Description The issue allows remote authenticated users to read arbitrary files or upload files to arbitrary locations via directory traversal vulnerabilities in the index.php file. This can be achieved by...

CVE-2013-4809: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in GetEventsServlet in HP ProCurve Manager PCM 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager IDM 4.0 allow remote attackers to execute arbitrary SQL commands via the 1 sort or 2 dir parameter...

cPanel - dir Cross-Site Scripting

cPanel - dir Cross-Site Scripting source: https://www.securityfocus.com/bid/57064/info cPanel is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

Path traversal

Absolute path traversal vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 allows remote administrators to read arbitrary files via a full pathname in the dir parameter in a contents/Files action...