Arbitrary File Download Vulnerability in ZrLog V2.1.1

ZrLog is a blogging program developed using Java. ZrLog V2.1.1 suffers from an arbitrary file download vulnerability, which can be exploited by an attacker to download any file on the server via a constructed path...

Arbitrary File Read Vulnerability in ClanSphere

ClanSphere is a web content management system primarily used for building tribal and eSports websites. ClanSphere suffers from an arbitrary file read vulnerability that can be exploited by an attacker to read any file on the server...

Arbitrary File Read Vulnerability in HkCMS

HkCMS has been committed to providing free and open source content management system for enterprise station building, HkCMS has excellent expansion and secondary development capabilities, can be adapted to enterprise lightweight system development and deployment. HkCMS arbitrary file reading...

HkCMS suffers from an arbitrary file download vulnerability

HkCMS has been committed to providing free and open source content management system for enterprise station building, HkCMS has excellent expansion and secondary development capabilities, can be adapted to enterprise lightweight system development and deployment. HkCMS arbitrary file download...

Arbitrary File Read Vulnerability in ShopXO

ShopXO is an open source enterprise-level open source e-commerce system. ShopXO arbitrary file read vulnerability, an attacker can use this vulnerability to obtain any file on the server...

UBUNTU-CVE-2018-14669

ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server...

Arbitrary File Download Vulnerability in Sida Fluoroplastics Co.

Remote server WEB service does not do suffix filtering and directory control on user-submitted download files, leading to malicious attackers to construct paths to download arbitrary server files. http://60.191.211.210:8088/yyoa/DownExcelBeanServlet?contenttype=username&contentvalue=&state=1&peri...

Directory Traversal Vulnerability in Xinhuo Co-ordination Office System Backend

Xinhuo Co-operation Office System is an open source and cross-platform office system. There is a directory traversal vulnerability in the background of the Xinhao Collaboration Office System, an attacker logging in to the system by modifying the file path when downloading files can traverse the...

Arbitrary File Download Vulnerability in Joomla! Ye*** Vi*** Sh*** Component

Joomla! is an open source content management system CMS. An arbitrary file download vulnerability exists in the Joomla!Ye Vi Sh component, which stems from the program's failure to correctly process data passed by the user, and can be exploited by an attacker to download arbitrary files on the...

PHP Proxy Local File Inclusion Vulnerability

PHP Proxy is a web-based proxy script designed to be fast, easy to customize, and capable of providing sophisticated website support. A local file inclusion vulnerability exists in PHP Proxy version 3.0.3, which can be exploited by an attacker to read files from the server...

CVE-2018-3766

Path traversal in buttle module versions = 0.2.0 allows to read any file in the server...

xtalk directory traversal vulnerability

xtalk is a module to support browser communication with node x. A directory traversal vulnerability exists in xtalk. An attacker can exploit this vulnerability by placing a '... /' sequence in a URL to gain access to the file system...

PT-2018-16155 · Npm +2 · Public +2

Name of the Vulnerable Software and Affected Versions: public versions prior to 0.1.3 Description: The issue arises from a lack of validation of the filePath, allowing a malicious user to read the content of any file with a known path due to a Path Traversal vulnerability. This is caused by...

CVE-2018-11808

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user which by default is "NT AUTHORITY / SYSTEM" by sending a specially...

CVE-2018-3744

The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL...

3CX Device Path Traversal Vulnerability

3CX devices is an IP phone device from 3CX USA. A path traversal vulnerability exists in 3CX devices. The vulnerability can be exploited to access a file on the server by using the 'file' parameter in the /api/RecordingList/download?file=request...

Arbitrary File Download Vulnerability in Campus Card Portal of Harbin Xinzhongxin Electronics Co.

Campus Card Portal is a digital campus solution. An arbitrary file download vulnerability exists in the Campus Card Portal of Harbin Xinzhongxin Electronics Co. The vulnerability allows an attacker to download arbitrary files from the server...

XXE Vulnerability in TRS Comment Plugin

TRS Comment plug-in developed by Topsy, widely used in the national government, enterprises and institutions portal of the general-purpose plug-ins. TRS Comment plug-in synchannel Servlet XXE vulnerability, an attacker can use the vulnerability to read any file on the server, traversing the serve...

Symantec Messaging Gateway Directory Traversal Vulnerability

Symantec Messaging Gateway is a spam filter that combines anti-spam, anti-virus, advanced content filtering and data leakage protection technologies from Symantec. A directory traversal vulnerability exists in Symantec Messaging Gateway version 10.6.2. An attacker can leverage the directory...

XXE Vulnerability in Ninth OA System

Ninth OA system is the OA system to install, implement, learn, operate and maintain. Ninth OA system DocumentBuilder db = ex.newDocumentBuilder; Document doc = db.parserequest.getInputStream; XXE vulnerability exists. An attacker can read arbitrary files on the server and obtain sensitive...