idreamsoft iCMS Server-Side Request Forgery Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A server-side request forgery vulnerability exists in idreamsoft iCMS version 7.0.9. An attacker can exploit the vulnerability to read sensitive files and access the intranet...

Cisco Policy Suite Local Information Disclosure Vulnerability

Cisco Policy Suite is a carrier-grade policy, charging, and subscriber data management solution. A local information disclosure vulnerability exists in the CLI of Cisco Policy Suite. The vulnerability stems from insufficient access control privileges. An attacker can exploit the vulnerability by...

CVE-2018-0392

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions i.e., World-Readable. An attacker could exploit this vulnerability by logging in to the CLI. An...

CVE-2018-0392

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions i.e., World-Readable. An attacker could exploit this vulnerability by logging in to the CLI. An...

Improper access control

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions i.e., World-Readable. An attacker could exploit this vulnerability by logging in to the CLI. An...

CVE-2018-0392

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions i.e., World-Readable. An attacker could exploit this vulnerability by logging in to the CLI. An...

Xinhuo Collaboration Office v1.7.8 has an arbitrary file download vulnerability

Xinhuo Co-operation Office System is an open source and cross-platform office system. Xinhao Collaboration Office System v1.7.8 has an arbitrary file download vulnerability, which can be exploited by attackers to download sensitive files...

File download vulnerability in OURPHP website builder v1.8.3

OURPHP is a brand, a PHP + MySQL development based on W3C standard building system. OURPHP website building system version V1.8.3 file download vulnerability, attackers can use the vulnerability to download sensitive files...

Arbitrary File Read Vulnerability in Metinfo Version 6.0.0 (Patch Bypass)

MetInfo is a content management system developed using PHP and Mysql. An arbitrary file read vulnerability exists in Metinfo version 6.0.0. An attacker can exploit the vulnerability to read sensitive files on a website bypassing previous patches...

Race condition

A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passengerinstanceregistrydir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but befor...

Dell EMC ECOM XML External Entity Injection Vulnerability

Dell EMC is the new name for the business following the completion of Dell's acquisition of EMC. An XML external entity injection vulnerability exists in Dell EMC ECOM. Allows an attacker to gain unauthorized access to files containing sensitive information or could be used to cause a denial of...

Sensitive File Disclosure (HTTP)

The script attempts to identify files containing sensitive data at the remote web server. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Pivotal Spring Framework Directory Traversal Vulnerability

Pivotal Spring Framework is the U.S. Pivotal Software, Inc. of a set of open source Java, Java EE application framework. A directory traversal vulnerability exists in Pivotal Spring Framework. A remote attacker can use the directory traversal character "..." to access an arbitrary file that...

Unauthorized Access Vulnerability in Library Bibliographic Retrieval System of Huifen Software

Huiwen software library bibliographic retrieval system is the Huiwen system of Jiangsu Huiwen Software Co. An unauthorized access vulnerability exists in the Huiwen Software Library Bibliographic Retrieval System. Allows an attacker to bypass privilege authentication and access sensitive...

Wordpress Plugin Site Editor 1.1.1 - Local File Inclusion

Wordpress Plugin Site Editor 1.1.1 - Local File Inclusion Product: Site Editor Wordpress Plugin - https://wordpress.org/plugins/site-editor/ Vendor: Site Editor Tested version: 1.1.1 CVE ID: CVE-2018-7422 CVE description A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1...

WordPress Plugin Site Editor 1.1.1 - Local File Inclusion

Product: Site Editor Wordpress Plugin - https://wordpress.org/plugins/site-editor/ Vendor: Site Editor Tested version: 1.1.1 CVE ID: CVE-2018-7422 CVE description A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitra...

Windows Remote Assistance Exploit Lets Hackers Steal Sensitive Files

You have always been warned not to share remote access to your computer with untrusted people for any reason—it's a basic cybersecurity advice, and common sense, right? But what if, I say you should not even trust anyone who invites or offer you full remote access to their computers. A critical...

WordPress Site Editor 1.1.1 Local File Inclusion Vulnerability

Exploit for php platform in category web applications Product: Site Editor Wordpress Plugin - https://wordpress.org/plugins/site-editor/ Vendor: Site Editor Tested version: 1.1.1 CVE ID: CVE-2018-7422 CVE description A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for...

PT-2018-18248 · Z Blogphp · Z-Blogphp

Name of the Vulnerable Software and Affected Versions: Z-BlogPHP version 1.5.1.1740 Description: There is a potential issue in Z-BlogPHP where the physical path of the web site may be leaked, as demonstrated by accessing certain files such as admin footer.php. However, it's noted that the softwar...

Information disclosure

File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station before 8.1.2-5469 allows remote authenticated users to obtain other user's sensitive files via the filename parameter...