SAP BusinessObjects Business Intelligence Platform Cross-Site Request Forgery Vulnerability

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. The product has report generation, analysis, data visualization and other functions. A cross-site request forgery vulnerability exists in SAP...

Arbitrary File Read Vulnerability in Fish Leap CMS

FishLeap CMS is a content management system specifically geared towards enterprise applications. Fishy CMS suffers from an arbitrary file read vulnerability, which can be exploited by an attacker to read arbitrary files on the server...

CVE-2020-25985

MonoCMS Blog 1.0 is affected by: Arbitrary File Deletion. Any authenticated user can delete files on and off the webserver php files can be unlinked and not deleted...

Information disclosure

When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system...

GHSA-4X7W-FRCQ-V4M3 Path Traversal in @wturyn/swagger-injector

All versions of @wturyn/swagger-injector are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured dist folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package...

GHSA-V4X8-GW49-7HV4 Path Traversal in swagger-injector

All versions of swagger-injector are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured dist folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package until a...

Path Traversal in f-serv

All versions of f-serv are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available...

GHSA-VX5W-CXCH-WWC9 Path Traversal in f-serv

All versions of f-serv are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available...

GHSA-CRF7-FVJX-863Q Path Traversal in zero

Versions of zero prior to 1.0.6 are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. Recommendation Upgrade to version 1.0.6 or later...

Path Traversal in file-static-server

All versions of file-static-server are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. Recommendation No fix is currently available. Consider using an alternative module until a fix is mad...

Path Traversal in ponse

Versions of ponse prior to 2.0.2 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation Upgrade to version 2.0.2 or later...

PT-2020-21552

Name of the Vulnerable Software and Affected Versions ponse versions prior to 2.0.2 Description The issue allows attackers to access server files outside of the served folder using relative paths due to the package's failure to sanitize URLs. This can be exploited through Path Traversal...

PT-2020-21462

Name of the Vulnerable Software and Affected Versions file-static-server versions all versions Description The issue is related to Path Traversal due to insufficient input sanitization in URLs. Attackers can access server files by using relative paths when fetching files. Recommendations For all...

CVE-2020-15124

In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. This is limited to files accessible to the application server user, eg. tomcat, but can potentially lead to the disclosure of sensitive...

Path traversal

In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. This is limited to files accessible to the application server user, eg. tomcat, but can potentially lead to the disclosure of sensitive...

CVE-2020-15124 Path traversal in Goobi viewer Core

In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. This is limited to files accessible to the application server user, eg. tomcat, but can potentially lead to the disclosure of sensitive...

Arbitrary File Deletion Vulnerability in MCMS

MCMS is a website building system of MINGFEI TECHNOLOGY CO. MCMS suffers from an arbitrary file deletion vulnerability. An attacker can exploit this vulnerability to delete arbitrary files from the server...

XML External Entity (XXE)

everrest-core is vulnerable to XML external entity XXE attacks. The external DTDs are not disabled by default, allowing an attacker to submit a malicious XML document to perform requests on behalf of the server or read system files...

Arbitrary File Deletion Vulnerability in Tongda CMS Blue Bilingual Corporate Website

Tongda CMS is a set of website management system specialized in building websites for small and medium-sized enterprises SMEs, which is developed by using PHP+MYSQL. Tongda CMS blue Chinese-English bilingual enterprise website has an arbitrary file deletion vulnerability that can be exploited by...

File Containment Vulnerability in MetInfo v5.0.4 of Changsha Mito Information Technology Co.

Mito enterprise building system MetInfo is a free and open source enterprise CMS. Changsha Mito Information Technology Co., Ltd MetInfo v5.0.4 version of the file contains a vulnerability that can be exploited by attackers to view sensitive server files...