XXE Vulnerability in Columns.asmx File of Microxia Online Learning Platform

Micro Xia Online Learning Platform is an online education system based on B/S architecture. A XXE vulnerability exists in the Columns.asmx file of MicroXia Online Learning Platform. An attacker can exploit the vulnerability to remotely read arbitrary files on the server...

WordPress MDC YouTube Downloader Plugin Directory Traversal Vulnerability

WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.MDC YouTube Downloader is one of the video download plugins. A path traversal vulnerability exists in version 2.1.0 of...

WordPress WP e-Commerce Shop Styling Plugin Directory Traversal Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL servers to set up a personal blog site.WP e-Commerce Shop Styling is one of the plug-ins used to improve the style of WP e-commerce store templates. A...

XXE Vulnerability in Employee.asmx File of Microxia Online Learning Platform

Micro Xia Online Learning Platform is an online education system based on B/S architecture. XXE vulnerability exists in the Employee.asmx file of MicroXia Online Learning Platform, which can be exploited by an attacker to remotely read arbitrary files on the server...

CVE-2017-6637

Cisco Prime Collaboration Provisioning (PCP) web interface vulnerability CVE-2017-6637 allows an authenticated, remote attacker to delete arbitrary files due to insufficient HTTP request input validation and lack of RBAC enforcement, via directory traversal on the affected system. Core issue: imp...

XXE Vulnerability in Microxia Online Learning Platform

Micro Xia Online Learning Platform is an online education system based on B/S architecture. XXE injection vulnerability exists in /Ajax/InResult.ashx, which can be exploited by an attacker to remotely read arbitrary files on the server...

FeiWa B2B2C mall system url parameter has remote file inclusion vulnerability

Flying Frog Mall System FeiWa B2B2C is an enterprise-level B2B2C e-commerce platform system, fully supporting PC, WAP, WeChat, APP and other terminal equipment. FeiWa B2B2C mall system url parameters exist remote file containment vulnerability. The vulnerability exists in the location "...

CVE-2017-8858

In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated privileged remote file write using the 'bprd' process...

CVE-2017-8858

In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated privileged remote file write using the 'bprd' process...

Remote file inclusion

In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated privileged remote file write using the 'bprd' process...

CVE-2017-8858

In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated privileged remote file write using the 'bprd' process...

CVE-2017-8858

CVE-2017-8858 affects Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. The issue is an unauthenticated, privileged remote file write via the bprd process. This is a remote, unauthenticated threat with high impact (CVE-2017-8858 is disclosed in multiple sources; no exploi...

Updated ghostscript packages fix security vulnerability

Various userparams in Ghostscript allow %pipe% in paths, allowing remote shell command execution CVE-2016-7976. The .libfile function in Ghostscript doesn't check PermitFileReading array, allowing remote file disclosure CVE-2016-7977. Reference leak in the .setdevice function in Ghostscript allow...

HPE Intelligent Management Center FileDownloadServlet fileName Directory Traversal (CVE-2017-5795)

A directory traversal vulnerability has been reported in HPE Intelligent Management Center. The vulnerability is due to a lack of proper input sanitization on the fileName parameter in FileDownloadServlet. A remote attacker can exploit this vulnerability by sending a maliciously crafted HTTP...

HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusion Vulnerabilit

Exploit for multiple platform in category web applications Source: https://blogs.securiteam.com/index.php/archives/3087 SSD Advisory – HPE OpenCall Media Platform OCMP Multiple Vulnerabilities Want to get paid for a vulnerability similar to this one? Contact us at: email protected Vulnerabilities...

Oracle PeopleSoft - PeopleSoftServiceListeningConnector XML External Entity via DOCTYPE

Exploit for windows platform in category web applications Application: Oracle PeopleSoft Versions Affected: PeopleSoft HCM 9.2 on PeopleTools 8.55 Vendor URL: http://oracle.com Bug: XXE Reported: 23.12.2016 Vendor response: 24.12.2016 Date of Public Advisory: 18.04.2017 Reference: Oracle CPU Apri...

HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting Remote File Inclusion

HPE OpenCall Media Platform OCMP 4.3.2 - Cross-Site Scripting Remote File Inclusion Source: https://blogs.securiteam.com/index.php/archives/3087 SSD Advisory – HPE OpenCall Media Platform OCMP Multiple Vulnerabilities Want to get paid for a vulnerability similar to this one? Contact us at:...

HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusion

Source: https://blogs.securiteam.com/index.php/archives/3087 SSD Advisory – HPE OpenCall Media Platform OCMP Multiple Vulnerabilities Want to get paid for a vulnerability similar to this one? Contact us at: [email protected] Vulnerabilities Summary The following advisory describes Reflected...

IBM Tivoli Application Dependency Discovery Manager Remote File Inclusion Vulnerability

IBM Tivoli Application Dependency Discovery Manager TADDM is a product in a suite of IT service management solutions from IBM USA that provides robust automated application mapping and discovery to help administrators understand the structure, state, configuration and change history of business...

JVN#18739672: WordPress plugin "Booking Calendar" vulnerable to directory traversal

The WordPress plugin "Booking Calendar" provided by wpdevelop contains a directory traversal vulnerability CWE-22. Impact A local file outside of the application on the server may be accessed by a remote attacker. Solution Update the Software Update to the latest version according to the...