idreamsoft iCMS Server-Side Request Forgery Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A server-side request forgery vulnerability exists in idreamsoft iCMS version 7.0.9. An attacker can exploit the vulnerability to read sensitive files and access the intranet...

IBM Sterling File Gateway Information Disclosure Vulnerability (CNVD-2018-14088)

IBM Sterling File Gateway is a suite of file transfer software from IBM in the United States. The software integrates different centers of file transfer activity and facilitates the secure exchange of file-based data over the Internet. A security vulnerability exists in IBM Sterling File Gateway...

PT-2018-12558

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.9 Description A Server-Side Request Forgery SSRF issue was found, allowing attackers to read sensitive files or access an intranet, potentially leading to other unspecified impacts. Recommendations For idreamsoft iC...

Cisco Policy Suite Local Information Disclosure Vulnerability

Cisco Policy Suite is a carrier-grade policy, charging, and subscriber data management solution. A local information disclosure vulnerability exists in the CLI of Cisco Policy Suite. The vulnerability stems from insufficient access control privileges. An attacker can exploit the vulnerability by...

CVE-2018-0392

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions i.e., World-Readable. An attacker could exploit this vulnerability by logging in to the CLI. An...

CVE-2018-0392

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions i.e., World-Readable. An attacker could exploit this vulnerability by logging in to the CLI. An...

Improper access control

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions i.e., World-Readable. An attacker could exploit this vulnerability by logging in to the CLI. An...

CVE-2018-0392

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions i.e., World-Readable. An attacker could exploit this vulnerability by logging in to the CLI. An...

Xinhuo Collaboration Office v1.7.8 has an arbitrary file download vulnerability

Xinhuo Co-operation Office System is an open source and cross-platform office system. Xinhao Collaboration Office System v1.7.8 has an arbitrary file download vulnerability, which can be exploited by attackers to download sensitive files...

CVE-2018-0392: Incorrect Permission Assignment for Critical Resource

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions i.e., World-Readable. An attacker could exploit this vulnerability by logging in to the CLI. An...

File download vulnerability in OURPHP website builder v1.8.3

OURPHP is a brand, a PHP + MySQL development based on W3C standard building system. OURPHP website building system version V1.8.3 file download vulnerability, attackers can use the vulnerability to download sensitive files...

Arbitrary File Read Vulnerability in Metinfo Version 6.0.0 (Patch Bypass)

MetInfo is a content management system developed using PHP and Mysql. An arbitrary file read vulnerability exists in Metinfo version 6.0.0. An attacker can exploit the vulnerability to read sensitive files on a website bypassing previous patches...

Race condition

A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passengerinstanceregistrydir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but befor...

Dell EMC ECOM XML External Entity Injection Vulnerability

Dell EMC is the new name for the business following the completion of Dell's acquisition of EMC. An XML external entity injection vulnerability exists in Dell EMC ECOM. Allows an attacker to gain unauthorized access to files containing sensitive information or could be used to cause a denial of...

PT-2018-6182

Name of the Vulnerable Software and Affected Versions: fast-http-cli affected versions not specified Description: The issue allows an attacker to access the filesystem by exploiting a directory traversal vulnerability in fast-http-cli. This can be achieved by placing "../" in the URL. For example...

PT-2018-6151

Name of the Vulnerable Software and Affected Versions: welcomyzt affected versions not specified Description: The issue allows an attacker to access the filesystem by exploiting a directory traversal vulnerability. This can be achieved by placing "../" in the URL. For example, an attacker can sen...

PT-2018-6135

Name of the Vulnerable Software and Affected Versions: tmock affected versions not specified Description: The issue allows an attacker to access the filesystem by exploiting a directory traversal vulnerability. This can be achieved by placing "../" in the URL. For example, an attacker can send a...

Sensitive File Disclosure (HTTP)

The script attempts to identify files containing sensitive data at the remote web server. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Pivotal Spring Framework Directory Traversal Vulnerability

Pivotal Spring Framework is the U.S. Pivotal Software, Inc. of a set of open source Java, Java EE application framework. A directory traversal vulnerability exists in Pivotal Spring Framework. A remote attacker can use the directory traversal character "..." to access an arbitrary file that...

Unauthorized Access Vulnerability in Library Bibliographic Retrieval System of Huifen Software

Huiwen software library bibliographic retrieval system is the Huiwen system of Jiangsu Huiwen Software Co. An unauthorized access vulnerability exists in the Huiwen Software Library Bibliographic Retrieval System. Allows an attacker to bypass privilege authentication and access sensitive...