Sendio Local File Inclusion Vulnerability

Sendio is affected by a Local File Inclusion vulnerability that allows an unauthenticated, remote attacker to read potentially sensitive system files via a specially crafted URL. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

Authentication Bypass

Moodle is vulnerable to authentication bypasses. A malicious user can pass a dataroot value to the system to bypass authentication and extract files on the system...

CVE-2016-10399

Sendio versions before 8.2.1 were affected by a Local File Inclusion vulnerability that allowed an unauthenticated, remote attacker to read potentially sensitive system files via a specially crafted URL...

CVE-2016-10399

Sendio versions before 8.2.1 were affected by a Local File Inclusion vulnerability that allowed an unauthenticated, remote attacker to read potentially sensitive system files via a specially crafted URL...

Geneko GWR Router Path Traversal Vulnerability

Geneko GWR routers are router devices. A directory traversal vulnerability exists in Geneko GWR routers, which allows remote attackers to submit specially crafted requests to obtain the contents of system files...

kitto directory traversal vulnerability

kitto is an interactive dashboard framework written using Elixir. A directory traversal vulnerability exists in kitto, which allows remote attackers to submit a specially crafted request to view the contents of system files with WEB privileges...

Directory traversal

In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value...

Arbitrary File Download Vulnerability in WeADMIN ITOSS IT Service Management Platform

WeADMIN ITOSS is a network management software. An arbitrary file download vulnerability exists in the WeADMIN ITOSS IT Service Management Platform, which can be exploited by attackers to download system files...

Huawei OceanStor UDS Information Disclosure Vulnerability

Huawei OceanStor UDS is a high-density storage node and distributed storage system based on ARM architecture from Huawei, China. A security vulnerability exists in the XML interface of Huawei OceanStor UDS V100R002C01SPC101 and earlier versions. A remote attacker can exploit this vulnerability by...

Cisco FireSIGHT System Software Arbitrary Code Execution Vulnerability

A vulnerability in the backup and restore functionality of Cisco FireSIGHT System Software could allow an authenticated, local attacker to execute arbitrary code on a targeted system. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, an...

[slackware-security] sudo

New sudo packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/sudo-1.8.20p1-i586-1slack14.2.txz: Upgraded. This update fixes a potential overwrite of arbitrary syste...

CVE-2017-6621

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to insufficient protection of...

CVE-2017-6621

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to insufficient protection of...

CVE-2017-6621

CVE-2017-6621 affects Cisco Prime Collaboration Provisioning web interface, where an unauthenticated attacker can disclose sensitive data via crafted HTTP responses due to insufficient protection of data in replies. It impacts Cisco Prime Collaboration Provisioning software releases 10.6–11.5. Co...

Franklin Fueling Systems TS-550 evo File Download Vulnerability

The Franklin Fueling Systems TS-550 evo is a fuel management system from Franklin Fueling Systems USA. The system monitors fuel storage and provides an intuitive and easy to recognize interface for alarm functions. A security vulnerability exists in the Franklin Fueling Systems TS-550 evo version...

SDCMS Attachment Management Plugin Has Arbitrary File Deletion Vulnerability

SDCMS is a fireworks network independent research and development of PHP three-in-one website management system. Php + Mysql architecture, support Php5.5-7.x series of versions. SDCMS php version of the latest version of the attachment management plug-in there are arbitrary file deletion...

CVE-2017-6564

On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the Guest user, which contains the lowest privileges, can post to the idSourceFileName parameter found within the /download directory. This ability allows for an attacker to download sensitive system files from the host machine such as...

WordPress Plugin WP Vault Local File Inclusion

Description: Type user access: any user. $GET“wpv-image” is not escaped in include file. File / Code: Path: /wp-content/plugins/wp-vault/trunk/wp-vault.php includedirnameFILE . "/images/" . $GET"wpv-image"; if isset$GET"wpvfileid" includedirnameFILE . "/wpv-file-handler.php"; exit; else if...

CVE-2017-2331

A firewall bypass vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based malicious attacker to bypass firewall policies, leading to authentication bypass methods, information disclosure, modification of system files, and...

CVE-2017-2329

An insufficient authentication vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unprivileged, authenticated, user to execute certain specific unprivileged system files capable of causing widespread denials of system services...