Cisco Network Analysis Module Software Directory Traversal Vulnerability

Cisco Network Analysis Module Software NAM is a network traffic analysis software from the American company Cisco Cisco. A directory traversal vulnerability exists in the web interface in Cisco NAM, which stems from the program's failure to perform proper input validation for HTTP requests. A...

Directory traversal

The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference...

The vulnerability of the reportId parameter in the getReportStatus method of the Kaspersky Anti-Virus for Linux File Server antivirus protection tool allows a hacker to access and read arbitrary files.

The vulnerability of the reportId parameter in the getReportStatus method of the Kaspersky Anti-Virus for Linux File Server antivirus tool is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to read arbitrary files wit...

Accellion File Transfer Appliance Path Traversal Vulnerability

Accellion File Transfer Appliance FTA is a file transfer solution from Accellion USA. The solution supports file transfer, file sharing, file transfer tracking and reporting, and more. A directory traversal vulnerability exists in the 'template' function of the functions.inc file in versions of...

File Containment Vulnerability in iWebShop Open Source Mall System

iWebShop is an open source WEB e-commerce B2B2C platform self-supporting + merchants stationed station-building system based on PHP language + MYSQL database development, using the MVC architecture Yii framework thinking design pattern carefully designed a product. iWebShop open source mall syste...

Qards - Stored Cross-Site Scripting (XSS)

Google Dork: inurl:"plugins/qards" Qards provides you easy option to drag and edit every part and element of your site in the front-end, you will never have to write any code to change the layout or to change any part of the site like the traditional WordPress way. The vulnerable script...

The vulnerability of the software tools for backup and data restoration in NetBackup Appliance and NetBackup allows a malicious individual to execute arbitrary commands in a privileged mode. This vulnerability is related to deficiencies in access control.

The vulnerability of software tools for backup and data restoration in NetBackup Appliance and NetBackup lies in the lack of access control mechanisms root/admin privileges. Exploiting this vulnerability allows a malicious actor to remotely copy any file and execute arbitrary commands with...

The vulnerability of the Vesta Control Panel server’s control panel lies in the lack of checking for the presence of a user session. This allows attackers to perform various manipulations on files and directories located on the server.

The vulnerability of the Vesta Control Panel’s control panel lies in the lack of checking for the presence of a user session in the files.php file web/file-manager/, which is responsible for the operation of the control panel’s file manager. Exploiting this vulnerability allows an attacker to...

CVE-2017-13984

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to delete arbitrary files via servlet directory traversal...

CVE-2017-13984

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to delete arbitrary files via servlet directory traversal...

CVE-2017-14849

Node.js 8.5.0 before 8.6.0 is vulnerable to directory traversal/file disclosure due to a changed handling of ".." that conflicts with pathname validation in some community modules. The issue allows remote attackers to access unintended files. A fix is available in Node.js 8.6.0 or later. If upgra...

FreeBSD : sugarcrm -- multiple vulnerabilities (3b776502-f601-44e0-87cd-b63f1b9ae42a)

sugarcrm developers report : An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26. Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection...

Multiple Vulnerabilities in Landesk Management Suite

Landesk Management Suite is a suite of IT system management solutions from LANDESK USA. The program supports software distribution, alarming and monitoring, remote management and control of desktops, servers and mobile devices. A remote file inclusion and cross-site request forgery vulnerability...

WordPress ZipArchive and PclZip Component Directory Traversal Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports in PHP and MySQL servers to set up a personal blog site . ZipArchive and PclZip components are among the compression/decompression components . A directory traversal...

Apps industrial OT over Server: Anti-Web Local File Inclusion(CVE-2017-9097)

Exploit Title: Apps industrial OT over Server: "Anti-Web 3.x.x 3.8.x" vuln: Local File Inclusion Date: 15/05/2017 Exploit Author: Bertin Jose @bertinjoseb && Fernandez Ezequiel @capitanalfa Vendor: Multiples vendors Category: Industrial OT webapps + DESCRIPTION: vulnerability: LFI Local File...

Remote file inclusion

The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusion attacks involving ASPX pages from third-party sites via the d parameter to 1 ldms/smactionfrm.asp or 2 remote/frmcoremainfrm.aspx; or the 3 top parameter to...

CVE-2014-5362

The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusion attacks involving ASPX pages from third-party sites via the d parameter to 1 ldms/smactionfrm.asp or 2 remote/frmcoremainfrm.aspx; or the 3 top parameter to...

CVE-2014-5362

The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusion attacks involving ASPX pages from third-party sites via the d parameter to 1 ldms/smactionfrm.asp or 2 remote/frmcoremainfrm.aspx; or the 3 top parameter to...

CVE-2014-5362

CVE-2014-5362 affects LANDESK/Landesk Management Suite 9.6 and earlier. The admin interface is vulnerable to remote file inclusion via insufficient input validation, exploitable by crafting requests that set the d parameter in ldms/sm_actionfrm.asp or remote/frm_coremainfrm.aspx, or the top param...

SugarCRM Remote File Inclusion Vulnerability

SugarCRM Professional is a professional version of an open source customer relationship management system CRM from SugarCRM USA. The system supports differentiated marketing for different customer needs, managing and distributing sales leads, and enabling information sharing and tracking of sales...