CVE-2018-11351

script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting XSS vulnerabilities. These are stored within the shared files description file and allow the execution of a JavaScript payload each time an administrator searches or lists uploaded files. These two injections could...

CVE-2018-11351

script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting XSS vulnerabilities. These are stored within the shared files description file and allow the execution of a JavaScript payload each time an administrator searches or lists uploaded files. These two injections could...

CVE-2018-11351: Improper Neutralization of Input During Web Page Generation

script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting XSS vulnerabilities. These are stored within the shared files description file and allow the execution of a JavaScript payload each time an administrator searches or lists uploaded files. These two injections could...

Command Injection in pdfinfojs

Versions of pdfinfojs before 0.4.1 are vulnerable to command injection. This is exploitable if an attacker can control the filename parameter that is passed into the pdfinfojs constructor. Recommendation Update to version 0.4.1 or later...

CVE-2018-11345

An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the POST parameter filename. This can be used to place attacker controlled code on the file system that can then be executed. Further, the filename parameter is...

Directory traversal

Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter...

CVE-2018-11341

Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter...

ASUSTOR AS6202T ADM Directory Traversal Vulnerability

ADM ASUSTOR Data Manager is the operating system and user interface for ASUSTOR NAS. A directory traversal vulnerability exists in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3. An attacker can exploit this vulnerability to navigate the file system via the filename parameter...

CVE-2018-11341: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter...

PT-2018-10503

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description The issue allows attackers to upload files via the filename parameter in the POST request to the "upload.cgi" endpoint. This can lead to the execution of attacker-controlled code on the file...

PT-2018-1370 · Pdfinfojs · Pdfinfojs

Name of the Vulnerable Software and Affected Versions: pdfinfojs versions = 0.3.6 pdfinfojs versions prior to 0.4.1 Description: The issue is related to a lack of neutralization of special elements in input commands for the pdfinfojs module. This can be exploited by a remote attacker to execute...

CVE-2018-9118

exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the filename parameter...

CVE-2018-9118

exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the filename parameter...

Directory traversal

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipients via a .. dot dot in the filename parameter to secupload2/upload.aspx...

PT-2018-18224

Name of the Vulnerable Software and Affected Versions: SecurEnvoy SecurMail versions prior to 9.2.501 Description: The issue allows remote authenticated users to read e-mail messages to arbitrary recipients. This is achieved by using a .. dot dot in the filename parameter to the...

Foxit MobilePDF for iOS Denial of Service Vulnerability

Foxit MobilePDF for iOS is China's Foxit Foxit software company's a cross iOS-based platform for mobile devices to use the PDF document reader. A denial of service vulnerability exists in the iOS-based Foxit MobilePDF application prior to version 6.1, which stems from the program's inability to...

Synology Surveillance Station File and Directory Information Disclosure Vulnerability

Synology Surveillance Station is a video management application from Synology, and User Profile is one of the user information storage files. An information disclosure vulnerability exists in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station versions prior to...

CVE-2017-16770

File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station before 8.1.2-5469 allows remote authenticated users to obtain other user's sensitive files via the filename parameter...

Information disclosure

File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station before 8.1.2-5469 allows remote authenticated users to obtain other user's sensitive files via the filename parameter...

CVE-2017-16770: Insertion of Sensitive Information into Externally-Accessible File or Directory

File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station before 8.1.2-5469 allows remote authenticated users to obtain other user's sensitive files via the filename parameter...