CVE-2014-2279: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allow 1 remote authenticated users with access to the LogManagement functionality to read arbitrary files via a .. dot dot in the logname parameter to out/out.LogManagement.php or 2 remote attackers to...

CVE-2014-2278: Improper Input Validation

Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the partitionIndex parameter and leveraging CVE-2014-2279.2 to access it...

Multiple Vulnerabilities in SeedDMS < = 4.3.3

Product description: ============ SeedDMS is the continuation of LetoDMS because it has lost its main developer. SeedDMS is an easy to use but powerful Open Source Document Management System. http://www.seeddms.org/index.php?id=2 ============ SeedDMS Unprivileged User Remote Code Execution...

CVE-2014-2280

Cross-site scripting XSS vulnerability in the search feature in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2014-2280

Cross-site scripting XSS vulnerability in the search feature in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2014-2280

SeedDMS (formerly LetoDMS/MyDMS) before version 4.3.4 is affected by a reflected XSS in the search feature. The vulnerability arises from the query parameter used by the search, allowing attackers to inject arbitrary scripts/HTML that are returned without proper validation or sanitization. Public...

CVE-2014-2280: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the search feature in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

SeedDMS '/op/op.AddFile2.php'任意文件上传漏洞

Bugtraq ID:66255 CVE ID:CVE-2014-2278 SeedDMS是一个强大易用的文档管理系统。 SeedDMS /op/op.AddFile2.php上传功能不充分的访问控制，允许攻击者控制上传文件的位置，并上传任意文件类型的文件，以服务器上下文执行任意代码。 0 SeedDMS 4.3.3 SeedDMS 4.3.4已经修复该漏洞，建议用户下载更新： https://sourceforge.net/projects/seeddms/files/seeddms-4.3.4/...

SeedDMS 'out.LogManagement.php'目录遍历漏洞

Bugtraq ID:66256 CVE ID:CVE-2014-2279 SeedDMS是一个强大易用的文档管理系统。 SeedDMS /out/out.LogManagement.php脚本不正确过滤'logname'参数数据，允许攻击者利用漏洞提交目录遍历序列，以WEB权限查看系统文件内容。 0 SeedDMS 4.3.3 SeedDMS 4.3.4已经修复该漏洞，建议用户下载更新： https://sourceforge.net/projects/seeddms/files/seeddms-4.3.4/...

SeedDMS XSS / Traversal / Shell Upload

Product description: ============ SeedDMS is the continuation of LetoDMS because it has lost its main developer. SeedDMS is an easy to use but powerful Open Source Document Management System. http://www.seeddms.org/index.php?id=2 ============ SeedDMS Unprivileged User Remote Code Execution...