CVE-2014-3319: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Real-Time Monitoring Tool RTMT in Cisco Unified Communications Manager CM 10.01 allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup57676...

PT-2014-6216

Name of the Vulnerable Software and Affected Versions BookX plugin version 1.7 for WordPress Description A directory traversal issue exists, allowing remote attackers to read arbitrary files by using a .. dot dot in the file parameter. Recommendations For BookX plugin version 1.7, update to a new...

PT-2014-5212

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager affected versions not specified Description A directory traversal issue exists in the Dialed Number Analyzer DNA component, allowing remote authenticated users to read arbitrary files via a crafted URL...

CVE-2014-3318: Improper Input Validation

Directory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer DNA component in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup76318...

PT-2014-5349

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform JEAP versions prior to 6.2.4 Description The issue is related to an XML External Entity XXE problem, where the org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor enables entity expansion. This...

PT-2014-2645

Name of the Vulnerable Software and Affected Versions IBM Tivoli Application Dependency Discovery Manager TADDM versions 7.1.x through 7.2.1.4 Description A directory traversal issue exists, allowing remote authenticated users to read arbitrary files. Recommendations For versions 7.1.x through...

PHPAlbum 0.2.3/4.1 - Local File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15651/info phpAlbum is prone to a local file-include vulnerability. An attacker may leverage this issue to execute arbitrary server-side script code that resides on an affected computer with the privileges of the webserve...

ovirt-engine-api: XML eXternal Entity (XXE) flaw

The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization rhevm 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity XXE issue...

CVE-2011-4367

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces JSF in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. dot dot in the 1 ln parameter to faces/javax.faces.resource/web.xml or 2 the PATHINFO to...

PT-2014-2169

Name of the Vulnerable Software and Affected Versions Apache MyFaces Core versions 2.0.x through 2.0.11 Apache MyFaces Core versions 2.1.x through 2.1.5 Description Multiple directory traversal issues in Apache MyFaces Core allow remote attackers to read arbitrary files. This is achieved by...

PT-2014-4984

Name of the Vulnerable Software and Affected Versions Belkin N150 F9K1009 v1 router with firmware before 1.00.08 Description The issue is related to an absolute path traversal vulnerability in the webproc cgi module. This allows remote attackers to read arbitrary files by providing a full pathnam...

CVE-2011-4367: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces JSF in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. dot dot in the 1 ln parameter to faces/javax.faces.resource/web.xml or 2 the PATHINFO to...

PT-2014-5801

Name of the Vulnerable Software and Affected Versions WebTitan versions prior to 4.04 Description A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by using a .. dot dot in the logfile parameter within a download action. Recommendations For...

PT-2014-2270

Name of the Vulnerable Software and Affected Versions GeSHi versions prior to 1.0.8.11 Description The issue concerns multiple directory traversal vulnerabilities in the cssgen contrib module. These vulnerabilities allow remote attackers to read arbitrary files by utilizing a .. dot dot in the...

PT-2014-4787

Name of the Vulnerable Software and Affected Versions DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC versions prior to 13.1.10 DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC versions 13.2.x prior to 13.2.9 Description The issue allows remote authenticated users t...

PT-2014-4456

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.15 ownCloud Server versions 6.0.x prior to 6.0.2 Description The issue allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity X...

PT-2014-4453

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.15 ownCloud Server versions 6.0.x prior to 6.0.2 Description The issue allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity X...

CVE-2012-5336: Improper Input Validation

lib/base.php in ownCloud before 4.0.8 does not properly validate the userid session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV...

PT-2014-4642

Name of the Vulnerable Software and Affected Versions Cogent DataHub versions prior to 7.3.5 Description A directory traversal issue allows remote attackers to read arbitrary files or cause a web-server denial of service via a crafted pathname. Recommendations For versions prior to 7.3.5, update ...

CVE-2014-3242

SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...