Access to all file-versions of a user as soon as he has one share with the attacker – ownCloud

------- An authenticated attacker can access all versions of all files even unshared as soon as the owner of said files has at least one outgoing share with the attacker. To attacker needs to guess a file-id which is numeric and sequential. Affected ----- - owncloud/core = v10.0.9 - owncloud/core...

CVE-2018-6576

SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter...

PT-2017-6810

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.2.19 and earlier Description The issue allows remote authenticated users to download attachments linked to arbitrary private projects. This is possible when the threshold to access files is set to ANYBODY. The file id...

File ID Poisoning

github.com/rfjakob/gocryptfs is vulnerable to file ID poisoning. A malicious user can change the contents of a file while retaining it's file ID...

ALPINE-CVE-2016-9102

Memory leak in the v9fsxattrcreate function in hw/9pfs/9p.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service memory consumption and QEMU process crash via a large number of Txattrcreate messages with the same fid number...

JINGLUN OA system /Systems/user_priv/manage. aspx file id parameter SQL injection vulnerability

No description provided by source...

致翔OA /OpenWindows/Openleibie_wtMc.aspx文件id参数SQL注入漏洞

No description provided by source...

HackerOne: Previous attachments can be referenced when creating a new report

Hello When user upload file in comment to report, user can find file ID by two ways: 1. In preview mode - In response to POST method https://hackerone.com/attachments , answer will be something like this: -"id":84577,"name":"mytestfile.png","size":32397 where fileID = 84577 for example 2. If user...

Ipswitch MOVEit DMZ MOVEitISAPI Information Disclosure Vulnerability

Ipswitch MOVEit is an automated file transfer system from Ipswitch USA. DMZ and Mobile are among the versions. Ipswitch MOVEit A security vulnerability exists in the MOVEitISAPI service of DMZ due to the sending of different error messages based on the presence or absence of a FileID. A remote...

PT-2014-5540

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 6.0.3 Description The issue affects the document application in ownCloud Server, where sequential values are used for the file id. This allows remote authenticated users to enumerate shared files...

Ultimate PHP Board 2.2.7 - Broken Authentication and Session Management

Ultimate PHP Board 2.2.7 - Broken Authentication and Session Management Exploit Title : Ultimate PHP Board 2.2.7 "Broken Authentication and Session Management" Date : 2011.05.17 Author : i2sec - Gi bum Hong Software Link : http://sourceforge.net/projects/textmb/files/UPB/UPB%202.2.7/ Version :...

CVE-2011-0794

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5.0 allows local users to affect confidentiality, integrity, and availability, related to File ID SDK. NOTE: the previous information was obtained from the April 2011 CPU. Oracle has not...

Buffer overflow

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5.0 allows local users to affect confidentiality, integrity, and availability, related to File ID SDK. NOTE: the previous information was obtained from the April 2011 CPU. Oracle has not...

CVE-2011-0794

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5.0 allows local users to affect confidentiality, integrity, and availability, related to File ID SDK. NOTE: the previous information was obtained from the April 2011 CPU. Oracle has not...

PT-2011-2643

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware version 8.3.5.0 Oracle Outside In Technology versions 8.3.5.x through 8.3.5.5684 Description The issue affects confidentiality, integrity, and availability. It is related to the File ID SDK. The vulnerability can be...

CVE-2011-0794: Undefined Security Weakness

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5.0 allows local users to affect confidentiality, integrity, and availability, related to File ID SDK. NOTE: the previous information was obtained from the April 2011 CPU. Oracle has not...

CVE-2008-6217: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Extrakt Framework 0.7 allows remote attackers to inject arbitrary web script or HTML via the pluginsfileid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in XRMS allow remote attackers to inject arbitrary web script or HTML via 1 the real name field, related to the user list; 2 the target parameter to login.php, 3 the title parameter to activities/some.php, 4 the companyname parameter to...

CVE-2006-4778

SQL injection vulnerability in Creative Commons Tools ccHost before 3.0 allows remote attackers to execute arbitrary SQL commands via a crafted URL, which is used to populate the file ID. NOTE: Some details are obtained from third party information...