DEBIAN-CVE-2018-14654

The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could exploit this via the 'GFXATTROPENTRYINKEY' xattrop to create arbitrary, empty files on the target server...

PT-2018-12645 · Red Hat +1 · Gluster +1

Name of the Vulnerable Software and Affected Versions: Gluster file system versions through 4.1.4 Description: The issue allows a remote attacker with access to mount volumes to exploit the GF XATTROP ENTRY IN KEY xattrop, creating arbitrary, empty files on the target server via abuse of the...

ALPINE-CVE-2018-18778

ACME minihttpd before 1.30 lets remote users read arbitrary files...

CVE-2018-18778

ACME minihttpd before 1.30 lets remote users read arbitrary files...

PT-2018-14591 · Phpyun · Phpyun

Name of the Vulnerable Software and Affected Versions: PHPYun version 4.6 Description: The issue allows remote attackers to read arbitrary files via directory traversal. This is possible through the function down sql action in the file /admin/model/database.class.php. The vulnerability can be...

CVE-2018-15750

Removed by vendor...

GHSA-QV32-7R6P-XHHH Moderate severity vulnerability that affects com.adobe.xmp:xmpcore

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2018-18485

An issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter. This can be leveraged to reload the product by deleting install.lock...

GHSA-2FW5-RVF2-JQ56 Apache Camel's XSLT component allows remote attackers to read arbitrary files

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External...

CVE-2018-1770

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 148686...

CVE-2018-12478

A Improper Input Validation vulnerability in Open Build Service allows remote attackers to extract files from the system where the service runs. Affected releases are openSUSE Open Build Service: status of is unknown...

PT-2018-34: XXE Injection in S3 Browser

The specialists of the Positive Research center have detected an XXE Injection vulnerability in S3 Browser. A vulnerability in the HTTP-based S3 protocol, due to server responses transmitted in XML format, allows remote attackers to read user files and obtain NTLMv2 hash values by tricking a user...

CVE-2018-17797

An issue was discovered in zzcms 8.3. user/zssave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-17798

An issue was discovered in zzcms 8.3. user/ztconfig.php allows remote attackers to delete arbitrary files via an absolute pathname in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-7109

HPE has addressed a remote arbitrary file modification vulnerability in HPE enhanced Internet Usage Manager eIUM v9.0FP1 with the cumulative patch for v9.0FP1 - eIUM90FP01XXX.YYYYMMDD-HHMM...

CVE-2018-7109

HPE has addressed a remote arbitrary file modification vulnerability in HPE enhanced Internet Usage Manager eIUM v9.0FP1 with the cumulative patch for v9.0FP1 - eIUM90FP01XXX.YYYYMMDD-HHMM...

CVE-2018-7109

HPE has addressed a remote arbitrary file modification vulnerability in HPE enhanced Internet Usage Manager eIUM v9.0FP1 with the cumulative patch for v9.0FP1 - eIUM90FP01XXX.YYYYMMDD-HHMM...

JavaMelody XML External Entity Injection Vulnerability

JavaMelody is a set of Java application monitoring tools. The tool is able to monitor Java or Java EE application servers in the QA and actual operation of the production environment , and in the form of graphs to display Java memory and Java CPU usage , the number of users Session , etc...

CVE-2018-17365

SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter...

HPESBGN03896 rev.1 - HPE enhanced Internet Usage Manager (eIUM), Remote Arbitrary File Modification

Potential Security Impact: Remote: Arbitrary File Modification SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE enhanced Internet Usage Manager eIUM 9.0 FP01 - Including customer specific versions based on 9.0 FP01 release. CVSS Scores: | CVE | CVSS Vector | Base Score | | --- ...