CVE-2017-14509

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26. A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a...

Input validation

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26. A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a...

CVE-2017-14509

SugarCRM CVE-2017-14509 concerns a remote file inclusion in the Connectors module of SugarCRM (versions prior to 7.7.2.3, 7.8.x before 7.8.2.2, 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26) exploitable by authenticated users via module=CallRest&url= in the query string. The issue arise...

sugarcrm -- multiple vulnerabilities

sugarcrm developers report: An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26. Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection,...

The vulnerability of the component supported by Git-style software, the GNU Patch Unix utility for operating systems like Ubuntu and Fedora, allows a hacker to modify any files they desire.

The vulnerability of the Git-style programmatic Unix utility GNU Patch for operating systems like Ubuntu and Fedora is related to deficiencies in pathname restrictions for directories. Exploiting this vulnerability allows a malicious actor to remotely modify arbitrary files with the target user’s...

AlegroCart Arbitrary Code Execution Vulnerability

AlegroCart is an open source online business solution from the Canadian ALEGROCART team. AlegroCart version 1.2.8 has a remote file inclusion vulnerability in the 'getfile' function of the upload/admin2/controller/reportlogs.php file, which stems from the program failing to detect the 'filepath'...

Synology Photo Station Directory Traversal Vulnerability (CNVD-2017-27711)

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A directory traversal vulnerability exists in Synology Photo Station versions prior to 6.7.4-3433 and synphotoio versions prior to 6.3-2968. A remote attacker can exploit the vulnerability to...

WordPress Gwolle Guestbook Plugin < 1.5.4 RFI Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112042";...

Directory traversal

PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allowurlinclude is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be...

Remote file inclusion

PHP remote file inclusion vulnerability in the getfile function in upload/admin2/controller/reportlogs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the filepath parameter to upload/admin2...

CVE-2015-9227

PHP remote file inclusion vulnerability in the getfile function in upload/admin2/controller/reportlogs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the filepath parameter to upload/admin2...

CVE-2015-8351

PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allowurlinclude is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be...

CVE-2015-9227

CVE-2015-9227 affects AlegroCart 1.2.8. The get_file function in upload/admin2/controller/report_logs.php is vulnerable to remote file inclusion, allowing an attacker to execute arbitrary PHP code via a URL provided in the file_path parameter. Public references (e.g., Exploit-DB) document exploit...

CVE-2015-8351

CVE-2015-8351 affects the WordPress Gwolle Guestbook Plugin prior to 1.5.4. The vulnerability is a PHP Remote File Inclusion via the abspath parameter to frontend/captcha/ajaxresponse.php, which can be exploited by remote authenticated users to execute arbitrary PHP code. The issue can also be le...

HPE BSM Platform Application Performance Management System Health Path Traversal Vulnerability (CNVD-2017-33007)

HPE BSM Platform Application Performance Management System Health is a suite of application performance management systems for the BSM platform from Hewlett Packard Enterprise HPE. A path traversal vulnerability exists in HPE BSM Platform Application Performance Management System Health versions...

CVE-2017-9095

XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import...

Aruba Networks ClearPass Policy Manager Arbitrary File Write Vulnerability

Aruba Networks ClearPass Policy Manager CPPM is a BYOD Bring Your Own Device network access control policy enforcement platform from Aruba Networks. A security vulnerability exists in Aruba Networks CPPM versions prior to 6.4.7 and 6.5.x versions prior to 6.5.2. A remote attacker could exploit th...

batik: XML external entity processing vulnerability

An XXE vulnerability was found in Apache Batik which could allow a remote attacker to retrieve the files on the vulnerable server's filesystem by uploading specially crafted SVG images. The vulnerability could also allow a denial of service condition by performing an amplification attack...

batik: XML external entity processing vulnerability

An XXE vulnerability was found in Apache Batik which could allow a remote attacker to retrieve the files on the vulnerable server's filesystem by uploading specially crafted SVG images. The vulnerability could also allow a denial of service condition by performing an amplification attack...

CVE-2015-1395

Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. dot dot in a diff file name...