1100 matches found
CVE-2017-17876: Undefined Security Weakness
Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter...
PT-2017-15065
Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System version 3.0 Description The issue allows remote attackers to bypass intended file-read restrictions. This can be achieved via a user=download request with a pathname in the path parameter...
CVE-2017-11511
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...
CVE-2017-11152
Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter...
Directory traversal
Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter...
CVE-2017-11152
Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter...
DzzOffice v1.3.1 Arbitrary File Download Vulnerability in Frontend
DzzOffice is a cloud storage management tool , based on the free open source release , can be used as a personal network disk , team , enterprise network disk for use . DzzOffice v1.3.1 front-end arbitrary file download vulnerability exists due to the program fails to share path parameter for...
PT-2017-11777
Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.7.3-3432 Synology Photo Station versions prior to 6.3-2967 Description The issue allows remote attackers to write arbitrary files via the path parameter in PixlrEditorHandler.php. Recommendations For...
PT-2017-6684
Name of the Vulnerable Software and Affected Versions phpMyBackupPro versions prior to 2.5 Description The issue allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to "scheduled.php", and making requests to injected...
PT-2017-6660
Name of the Vulnerable Software and Affected Versions Etherpad versions 1.1.1 through 1.5.2 Description The issue allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests, such as "/api/" endpoints...
MODX Revolution 'setup/templates/findcore.php' file remote code execution vulnerability
MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A security vulnerability exists in the setup/templates/findcore.php file in MODX Revolution 2.5.4-pl and...
PT-2017-9086
Name of the Vulnerable Software and Affected Versions Plone CMS versions 4.2.x through 4.3.11 Plone CMS versions 5.x through 5.0.6 Description The issue allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in a getFile action to the...
CVE-2017-6480
groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php path parameter...
Cross site scripting
groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php path parameter...
CVE-2017-6480
groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php path parameter...
CVE-2017-6480
groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php path parameter...
CVE-2017-6480: Improper Neutralization of Input During Web Page Generation
groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php path parameter...
PT-2017-17097
Name of the Vulnerable Software and Affected Versions groovel/cmsgroovel versions prior to 3.3.7-beta Description The issue is related to a reflected XSS in the commons/browser.php file, specifically affecting the path parameter. Recommendations For versions prior to 3.3.7-beta, update to version...
Design/Logic Flaw
An issue was discovered in ionize through 1.0.8. The vulnerability exists due to insufficient filtration of user-supplied data in the "path" HTTP GET parameter passed to the "ionize-master/themes/admin/javascript/tinymce/jscripts/tinymce/plugins/codemirror/dialog.php" URL. An attacker could execu...
CVE-2017-5961
Ionize versions up to 1.0.8 (IONIZE CMS built on CodeIgniter) are affected by an XSS vulnerability due to insufficient filtration of user-supplied data in the path parameter of the URL to ionize-master/themes/admin/javascript/tinymce/jscripts/tiny_mce/plugins/codemirror/dialog.php. This could all...