CVE-2017-10617

The ifmap service that comes bundled with Contrail has an XML External Entity XXE vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0...

CVE-2017-10617 Contrail: XML External Entity (XXE) vulnerability

The ifmap service that comes bundled with Contrail has an XML External Entity XXE vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0...

Xxe

OpenText Document Sciences xPression formerly EMC Document Sciences xPression v4.5SP1 Patch 13 older versions might be affected as well is prone to an XML External Entity vulnerability: /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/. An unauthenticated user is able to read directory...

FreeBSD : sugarcrm -- multiple vulnerabilities (3b776502-f601-44e0-87cd-b63f1b9ae42a)

sugarcrm developers report : An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26. Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection...

SugarCRM Multiple Vulnerabilities (Sep 2017)

SugarCRM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sugarcrm:sugarcrm"; if description...

Directory Traversal Vulnerability in Tenda W15E Devices

The Tenda W15E devices is a dual-band wireless router from China's Tenda. A directory traversal vulnerability exists in the Tenda W15E devices, which allows remote attackers to submit a special request to view the contents of system files in an application context...

SugarCRM Remote File Inclusion Vulnerability

SugarCRM Professional is a professional version of an open source customer relationship management system CRM from SugarCRM USA. The system supports differentiated marketing for different customer needs, managing and distributing sales leads, and enabling information sharing and tracking of sales...

Input validation

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26. A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a...

CVE-2017-14509

SugarCRM CVE-2017-14509 concerns a remote file inclusion in the Connectors module of SugarCRM (versions prior to 7.7.2.3, 7.8.x before 7.8.2.2, 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26) exploitable by authenticated users via module=CallRest&url= in the query string. The issue arise...

Cisco Prime Collaboration Provisioning Tool Arbitrary File Overwrite Vulnerability

Cisco Prime Collaboration Provisioning Tool is a set of Web-based, next-generation communications services tools from Cisco. The tool provides IP communication services capabilities for IP telephony, voice mail and unified communications environments. A security vulnerability exists in the batch...

Input validation

A vulnerability in the batch provisioning feature in Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to overwrite system files as root. The vulnerability is due to lack of input validation of the parameters in BatchFileName and Directory. An attacker coul...

Cisco Prime Collaboration Provisioning Tool System File Overwrite Vulnerability

A vulnerability in the batch provisioning feature in Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to overwrite system files as root. The vulnerability is due to lack of input validation of the parameters in BatchFileName and Directory. An attacker coul...

CVE-2017-7693

Directory traversal vulnerability in viewerscript.jsp in Riverbed OPNET App Response Xpert ARX version 9.6.1 allows remote authenticated users to inject arbitrary commands to read OS files...

CVE-2017-12694

A Directory Traversal issue was discovered in SpiderControl SCADA Web Server. An attacker may be able to use a simple GET request to perform a directory traversal into system files...

SpiderControl SCADA Web Server Directory Traversal Vulnerability

SCADA Web Server is the software management platform. SCADA Web Server has a directory traversal vulnerability in its implementation that allows an attacker to perform directory traversal of system files via a simple GET request...

Directory Traversal Vulnerability in Extremecom EWEBS Application Virtualization System

ExtremeWire EWEBS Application Virtualization System is a virtual application platform developed primarily for enterprise users. A directory traversal vulnerability exists in the Extremecom EWEBS Application Virtualization System. A remote attacker can exploit this vulnerability to view system fil...

SpiderControl SCADA Web Server

CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: SpiderControl Equipment: SCADA Web Server Vulnerability: Directory Traversal AFFECTED PRODUCTS The following versions of SpiderControl SCADA Web Server, a software management platform, are affected: SCADA Web Server...

UnRAR Directory Traversal Vulnerability

UnRAR is a command line document decompression program for use on Windows and Linux platforms. UnRAR suffers from a directory traversal vulnerability that allows remote attackers to exploit the vulnerability to construct malicious files that can be parsed by the user and can overwrite system file...

Cisco ASR 5000 Series Aggregated Services Routers StarOS Arbitrary File Write Vulnerability

Cisco ASR 5000 Series Aggregated Services Routers are the ASR 5000 Series Aggregated Services Router products from Cisco.StarOS is the set of operating systems that run on them. An arbitrary file write vulnerability exists in StarOS in Cisco ASR 5000 Series Aggregated Services Routers version...

CVE-2017-6774

CVE-2017-6774 affects Cisco ASR 5000 Series Aggregated Services Routers running StarOS. The issue is an arbitrary file write via FTP: sensitive system/configuration files can be overwritten because they are exposed in specific FTP subdirectories. A remote, authenticated attacker could exploit thi...