CVE-2018-1999018

Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution RCE vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow$nodeObject that can result in An attacker gaining admin access and can then execute arbitrary commands on the...

CVE-2018-1999016

CVE-2018-1999016 affects Pydio 8.2.0 and earlier, with a Cross Site Scripting vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php (line 48) and ./core/vendor/dapphp/securimage/examples/test.mysql.static.php (lines 114, 118). An unauthenticated remote attacker could manipula...

CVE-2018-1999017

Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery SSRF vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath$url that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appear...

CVE-2018-1999018

CVE-2018-1999018 affects Pydio v8.2.1 and earlier. The root cause is unvalidated user input in the AntivirusScanner.php (plugins/action.antivirus/AntivirusScanner.php) function scanNow($nodeObject), enabling Remote Code Execution. The vulnerability can allow an attacker with access to edit the An...

CVE-2018-1999017

Pydio 8.2.0 and earlier contains a Server-Side Request Forgery (SSRF) in plugins/action.updater/UpgradeManager.php at line 154 (getUpgradePath($url)). An authenticated admin can cause the server to request arbitrary URLs by entering a URL into the Upgrade Engine and reloading. The issue is mitiga...

CVE-2018-1999016

Pydio version 8.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated remote attacker manipulating...

Pydio Core Detection (HTTP)

HTTP based detection of Pydio Core. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.113003";...

Pydio Core < 6.0.7 Multiple Vulnerabilities

Pydio Core is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:pydio:pydio"; if description...

Command injection

Pydio formerly AjaXplorer before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities."...

CVE-2015-3431

Pydio formerly AjaXplorer before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities."...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Pydio formerly AjaXplorer before 6.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Pydio XSS Vulnerabilities."...

CVE-2015-3432

Multiple cross-site scripting XSS vulnerabilities in Pydio formerly AjaXplorer before 6.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Pydio XSS Vulnerabilities."...

CVE-2015-3431

Pydio formerly AjaXplorer before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities."...

CVE-2015-3432

Multiple cross-site scripting XSS vulnerabilities in Pydio formerly AjaXplorer before 6.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Pydio XSS Vulnerabilities."...

CVE-2015-3431

Pydio Core (formerly AjaXplorer)

CVE-2015-3432

Pydio Core before 6.0.7 has multiple XSS vulnerabilities allowing remote script/HTML injection via unspecified vectors. Affected: Pydio Core (pre-6.0.7). Root cause: cross-site scripting in the web application component. Impact: potential execution of arbitrary scripts in user browsers. Remediati...

CVE-2017-5960

An issue was discovered in Phalcon Eye through 0.4.1. The vulnerability exists due to insufficient filtration of user-supplied data in multiple HTTP GET parameters passed to the "phalconeye-master/public/external/pydio/plugins/editor.webodf/frame.php" URL. An attacker could execute arbitrary HTML...

pydio.com XSS vulnerability

Vulnerable URL: https://pydio.com/search?s=%3C/span%3E%3Csvg/onload=alert%28%27OPENBUGBOUNTY%27%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 111912 VIP website status:| No Check pydio.com SSL connection:...

AjaXplorer vulnerable to directory traversal

Overview AjaXplorer contains an issue in processing file names, which may result in a directory traversal CWE-22 vulnerability. Daiki Fukumori of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

JVN#27462572: AjaXplorer vulnerable to directory traversal

AjaXplorer contains an issue in processing file names, which may result in a directory traversal CWE-22 vulnerability. Impact An authenticated attacker may view files on the server. Solution Use Pydio The developer states that the development of AjaXplorer has been discontinued and there are no...