CVE-2019-10045

The "action" getsessid in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her if the session is...

Design/Logic Flaw

The "action" getsessid in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her if the session is...

Command injection

The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of user supplied input in the plugin's configuration options, allowing arbitrary shell commands to be entered that result in command execution on the underlying...

Cross site scripting

A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be use...

CVE-2019-10045

The "action" getsessid in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her if the session is...

CVE-2019-10049

It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into opening a link shared through the application, that in turn opens a shared file that contains JavaScript code that is executed in the context of the victim use...

CVE-2019-10049

The CVE-2019-10049 entry concerns Pydio Core (versions up to 8.2.2) where a user with regular access can be manipulated into opening a shared file containing JavaScript that runs in the victim’s browser context, enabling leakage of sensitive data (e.g., session identifiers) and actions on behalf ...

CVE-2019-10048

The CVE-2019-10048 entry concerns Pydio up to version 8.2.2 where the ImageMagick plugin does not validate/sanitize user input in its configuration options. This enables an authenticated administrator to enter arbitrary shell commands, causing command execution on the underlying OS with the web s...

CVE-2019-10048

The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of user supplied input in the plugin's configuration options, allowing arbitrary shell commands to be entered that result in command execution on the underlying...

CVE-2019-10047

CVE-2019-10047 is a stored XSS vulnerability in Pydio Core ≤ 8.2.2, exploitable via the file upload and file preview features of the web application. An authenticated attacker can upload an HTML file containing JavaScript and a subsequent file-preview URL can render that file, causing the script ...

CVE-2019-10047

A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be use...

CVE-2019-10046

CVE-2019-10046 affects Pydio 8.2.2 and is an information-disclosure vulnerability where an unauthenticated attacker can obtain details about the application configuration (e.g., session timeout, libraries, license information). Public sources (NVD, RH Red Hat advisory, OpenVAS entry) describe it ...

CVE-2019-10045

The "action" getsessid in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her if the session is...

CVE-2019-10045

CVE-2019-10045 affects Pydio (web application) up to version 8.2.2, where the action get_sess_id leaks the session cookie value in the HTTP response body. This enables a script to access the session identifier and potentially impersonate a user if a session is active. The issue is a result of lea...

Pydio Cross-Site Scripting Vulnerability (CNVD-2019-14091)

Pydio AjaXplorer is a web-based remote file manager. The manager supports uploading and downloading files, online file editing, image previewing and more. A cross-site scripting vulnerability exists in Pydio version 8, which stems from a lack of proper validation of client-side data by the WEB...

Pydio 8 Command Execution / Cross Site Scripting

SecureAuth - SecureAuth Labs Advisory http://www.secureauth.com/ Pydio 8 Multiple Vulnerabilities 1. Advisory Information Title: Pydio 8 Multiple Vulnerabilities Advisory ID: SAUTH-2019-0002 Advisory URL: https://www.secureauth.com/labs/advisories/pydio-8-multiple-vulnerabilities Date published:...

Pydio 8 Command Execution / Cross Site Scripting Vulnerabilities

Pydio 8 suffers from cross site scripting, command injection, and various other vulnerabilities. Pydio 8 Multiple Vulnerabilities 1. Advisory Information Title: Pydio 8 Multiple Vulnerabilities Advisory ID: SAUTH-2019-0002 Advisory URL:...

Pydio / AjaXplorer < 5.0.4 - Unauthenticated Arbitrary File Upload Exploit

Exploit for php platform in category web applications Exploit Title: Unauthenticated Arbitrary File Upload Vulnerability In Pydio/AjaXplorer 5.0.3 – 3.3.5 Exploit Author: @jazz Vendor Homepage: https://pydio.com/ Software Link:...

Pydio / AjaXplorer 5.0.3 Shell Upload / Directory Traversal

Exploit Title: Unauthenticated Arbitrary File Upload Vulnerability In Pydio/AjaXplorer 5.0.3 a 3.3.5 Date: 01/18/2019 Exploit Author: @jazz Vendor Homepage: https://pydio.com/ Software Link:...

Pydio AjaXplorer 5.0.4 - (Unauthenticated) Arbitrary File Upload

Pydio AjaXplorer 5.0.4 - Unauthenticated Arbitrary File Upload Exploit Title: Unauthenticated Arbitrary File Upload Vulnerability In Pydio/AjaXplorer 5.0.3 – 3.3.5 Date: 01/18/2019 Exploit Author: @jazz Vendor Homepage: https://pydio.com/ Software Link:...