CVE-2018-15684: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory /include/logs using predictable file names, which can lead to full path disclosure and leakage of sensitive data...

PT-2018-13143

Name of the Vulnerable Software and Affected Versions BTITeam XBTIT affected versions not specified Description An issue in BTITeam XBTIT allows PHP error logs to be stored in an open directory /include/logs with predictable file names. This can lead to full path disclosure and the leakage of...

Command Execution Vulnerability in OTCMS v3.53

Net Titanium Article Management System OTCMS is a simple and good asp article management system. A command execution vulnerability exists in OTCMS v3.53. An attacker can use the vulnerability to obtain website path information and write PHP code to gain server privileges...

CVE-2018-12990

phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrftokenvalue field...

CVE-2018-12990

phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrftokenvalue field...

PT-2018-11520

Name of the Vulnerable Software and Affected Versions phpwcms version 1.8.9 Description The issue allows remote attackers to discover the installation path via an invalid csrf token value field. Recommendations For phpwcms version 1.8.9, update to a newer version that contains a fix for this issu...

CVE-2018-12536

CVE-2018-12536 affects Eclipse Jetty Server (9.x) when webapps use the DefaultServlet/Default Error handling. A specially crafted bad query targeting non-matching URLs can trigger java.nio.file.InvalidPathException during static file serving, and if the error handler reveals the exception message...

CVE-2018-12632

The CVE affects Redatam7 (formerly Redatam WebServer). Affected component: the rpwebutilities.exe/text endpoint, where an invalid LFN parameter enables remote attackers to discover the installation path, indicating a path-disclosure/directory-traversal type exposure. No exploit details or remedia...

Redatam Directory Traversal Vulnerability

Redatam is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:redatam:redatam"; if...

Path traversal

Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird 52.5.2...

CMS Made Simple Physical Path Disclosure Vulnerability (CNVD-2018-09058)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMSMS 2.2.7 and...

Path traversal

mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field...

CVE-2018-10424

mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field...

CVE-2018-10424

mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field...

CVE-2018-10424

MiniCMS 1.10 is affected. The vulnerability is in mc-admin/post-edit.php where a modified id field allows full path disclosure. The root cause is a path disclosure issue that leads to information exposure. Exploitation details and mitigations are not provided in the supplied documents.

CVE-2018-10424

mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field...

CVE-2018-10424

mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field...

PT-2018-9877

Name of the Vulnerable Software and Affected Versions: MiniCMS version 1.10 Description: The issue in MiniCMS allows for full path disclosure through a modified id field in the mc-admin/post-edit.php file. Recommendations: For MiniCMS version 1.10, update the mc-admin/post-edit.php file to proper...

CVE-2018-10424: Exposure of Sensitive Information to an Unauthorized Actor

mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field...

MiniCMS Information Disclosure Vulnerability

MiniCMS is a mini content management system CMS designed for personal websites. A security vulnerability exists in the mc-admin/post-edit.php file in MiniCMS version 1.10. An attacker can exploit the vulnerability by changing the id field to obtain the full path...