I, Librarian Catalog Enumeration Vulnerability

Scilico I, Librarian is the United States Scilico company a set of online PDF document management system. A security vulnerability exists in the jqueryFileTree.php file in Scilico I, Librarian versions 4.6 and earlier and 4.7. An attacker can exploit the vulnerability to enumerate directories...

CVE-2017-1000234: Exposure of Sensitive Information to an Unauthorized Actor

I, Librarian version =4.6 & 4.7 is vulnerable to Directory Enumeration in the jqueryFileTree.php resulting in attacker enumerating directories simply by navigating through the "dir" parameter...

PT-2017-10928

Name of the Vulnerable Software and Affected Versions I, Librarian versions prior to 4.8 Description The issue allows an attacker to enumerate directories by navigating through the dir parameter in the jqueryFileTree.php. This enables the attacker to list directories, potentially revealing...

PT-2017-10930

Name of the Vulnerable Software and Affected Versions I, Librarian versions prior to 4.7 Description The issue allows for Server-Side Request Forgery in the ajaxsupplement.php file, enabling an attacker to reset any user's password. Recommendations For versions prior to 4.7, consider restricting...

Sql injection

SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAXlookuphandler.php tableName and tableFields parameters, admin/AJAXcheckid.php, and admin/AJAXvocabolarycontrol.php. It can be exploited by remote authenticated librarian users...

CVE-2017-12585

SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAXlookuphandler.php tableName and tableFields parameters, admin/AJAXcheckid.php, and admin/AJAXvocabolarycontrol.php. It can be exploited by remote authenticated librarian users...

CVE-2017-12585

SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAXlookuphandler.php tableName and tableFields parameters, admin/AJAXcheckid.php, and admin/AJAXvocabolarycontrol.php. It can be exploited by remote authenticated librarian users...

CVE-2017-12585

SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAXlookuphandler.php tableName and tableFields parameters, admin/AJAXcheckid.php, and admin/AJAXvocabolarycontrol.php. It can be exploited by remote authenticated librarian users...

CVE-2017-12585

SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAXlookuphandler.php tableName and tableFields parameters, admin/AJAXcheckid.php, and admin/AJAXvocabolarycontrol.php. It can be exploited by remote authenticated librarian users...

CVE-2017-12586

SLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php. It can be exploited by remote authenticated librarian users...

CVE-2017-12586

The CVE-2017-12586 issue affects SLiMS 8 Akasia up to version 8.3.1. Affected component: admin/help.php URL parameter handling, where a directory traversal flaw allows arbitrary file reading. It can be exploited by remote authenticated librarian users. The connected sources confirm the vulnerabil...

PT-2017-12589

Name of the Vulnerable Software and Affected Versions SLiMS versions 8 Akasia through 8.3.1 Description The issue allows for SQL injection through specific parameters and files, including tableName and tableFields in admin/AJAX lookup handler.php, as well as vulnerabilities in admin/AJAX check...

CVE-2017-12586: Improper Limitation of a Pathname to a Restricted Directory

SLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php. It can be exploited by remote authenticated librarian users...

CVE-2017-12585: Improper Neutralization of Special Elements used in an SQL Command

SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAXlookuphandler.php tableName and tableFields parameters, admin/AJAXcheckid.php, and admin/AJAXvocabolarycontrol.php. It can be exploited by remote authenticated librarian users...

I, Librarian PDF Manager Command Injection Vulnerability

I, Librarian PDF Manager is an online service that will organize your collection of PDF and office documents. I, Librarian PDF Manager suffers from a command injection vulnerability. An attacker can exploit this vulnerability to inject arbitrary HTML...

I, Librarian PDF Manager Cross-Site Scripting Vulnerability

I, Librarian PDF Manager is an online service that will organize your collection of PDF and office documents. A cross-site scripting vulnerability exists in I, Librarian PDF Manager. An attacker could exploit this vulnerability to cause an information disclosure...

I, Librarian PDF Manager Directory Enumeration Vulnerability

I, Librarian PDF Manager is an online service that will organize your collection of PDF and office documents. A directory enumeration vulnerability exists in I, Librarian PDF Manager, which can be exploited by an attacker to enumerate files in a web server directory...

I, Librarian PDF Manager 4.6 / 4.7 Command Injection / SSRF / Enumeration

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: I, Librarian PDF manager vulnerable version: =4.6 & 4.7 fixed version: 4.8 CVE number: - impact: Critical homepage:...

I_ Librarian 4.64.7 - Command Injection Server Side Request Forgery Directory Enumeration Cross-Site Scripting

I Librarian 4.64.7 - Command Injection Server Side Request Forgery Directory Enumeration Cross-Site Scripting SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: I, Librarian PDF manager...

Librarian PDF Manager 4.6 / 4.7 Command Injection / SSRF / Enumeration

I, Librarian PDF Manager versions 4.6 and below along with version 4.7 suffer from command injection, server-side request forgery, cross site scripting, and directory enumeration vulnerabilities. ======================================================================= title: Multiple vulnerabiliti...