PYSEC-2017-40

Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring...

CVE-2017-16762

Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring...

Roundcube Webmail Arbitrary File Access Vulnerability

RoundCube Webmail is a browser-based IMAP client mail client that supports address book management, message searching, spell checking and more. A security vulnerability exists in Roundcube Webmail versions prior to 1.1.10, 1.2.x versions prior to 1.2.7, and 1.3.x versions prior to 1.3.3. An...

UBUNTU-CVE-2017-16651

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid...

ALPINE-CVE-2017-16651

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid...

UBUNTU-CVE-2014-2277

The maketemporaryfilename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function...

CVE-2017-1577

IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 132117...

The vulnerability of the component supported by Git-style software, the GNU Patch Unix utility for operating systems like Ubuntu and Fedora, allows a hacker to modify any files they desire.

The vulnerability of the Git-style programmatic Unix utility GNU Patch for operating systems like Ubuntu and Fedora is related to deficiencies in pathname restrictions for directories. Exploiting this vulnerability allows a malicious actor to remotely modify arbitrary files with the target user’s...

SAP NetWeaver Application Server Java Directory Traversal Vulnerability (CNVD-2017-29433)

SAP NetWeaver is SAP's integrated service-oriented application platform that provides a development and runtime environment for SAP applications. SAP NetWeaver Application Server AS Java is an application server that runs on NetWeaver and is based on the Java programming language. SAP NetWeaver...

ClipBucket 2.8.3 - Multiple Vulnerabilities

ClipBucket 2.8.3 - Multiple Vulnerabilities @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ .:. Exploit Title ClipBucket 2.8.3 - Multiple Vulnerabilities .:. Google Dorks .:. "Forged by ClipBucket" inurl:viewcollection.php?cid= .:. Date: August 15, 2017 .:...

CVE-2015-3614

Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to obtain arbitrary files via vectors involving another unspecified vulnerability...

SAP TREX Code Injection Vulnerability

SAP TREX is a search engine from SAP for the SAP NetWeaver integrated technology platform. A code injection vulnerability exists in SAP TREX version 7.10. The vulnerability can be exploited by a remote attacker to read or write to arbitrary files and execute arbitrary code with the help of the fd...

CVE-2016-10400

Directory Traversal exists in ATutor before 2.2.2 via the icon parameter to /mods/core/courses/users/createcourse.php. The attacker can read an arbitrary file by visiting getcourseicon.php?id= after the traversal attack...

Sitecore CMS 8.2 Cross Site Scripting / File Disclosure Vulnerabilities

Sitecore CMS version 8.2 suffers from cross site scripting and file disclosure vulnerabilities. Exploit title: Sitecore CMS v8.2 multiple vulnerabilities Product: Sitecore Version: 8.2, Rev: 161221, Date: 21st December, 2016 Date: 05-05-2017 Author: Usman Saeed Email: email protected Vendor...

Sitecore CMS 8.2 Cross Site Scripting / File Disclosure

Exploit title: Sitecore CMS v8.2 multiple vulnerabilities Product: Sitecore Version: 8.2, Rev: 161221, Date: 21st December, 2016 Date: 05-05-2017 Author: Usman Saeed Email: [email protected] Vendor Homepage: http://www.sitecore.net/ Disclaimer: Everything mentioned below is for educational puposes...

BOA Web Server 0.94.14rc21 - Arbitrary File Access Vulnerability

Exploit for linux platform in category web applications BOA Web Server 0.94.14 - Access to arbitrary files as privileges Title: Vulnerability in BOA Webserver 0.94.14 Date: 20-06-2017 Status: Vendor contacted, patch available Scope: Arbitrary file access Platforms: Unix Author: Miguel Mendez Z...

BOA Web Server 0.94.14rc21 Arbitrary File Access

BOA Web Server 0.94.14 - Access to arbitrary files as privileges Title: Vulnerability in BOA Webserver 0.94.14 Date: 20-06-2017 Status: Vendor contacted, patch available Scope: Arbitrary file access Platforms: Unix Author: Miguel Mendez Z Vendor Homepage: http://www.boa.org Version: Boa Webserver...

Arbitrary File Read Vulnerability in catfishCMS

CatfishCMS is open source and free PHP CMS web content management system. An arbitrary file read vulnerability exists in catfishCMS. An attacker can exploit this vulnerability to obtain sensitive information in the database...

BOA Web Server 0.94.14rc21 - Arbitrary File Access

BOA Web Server 0.94.14rc21 - Arbitrary File Access BOA Web Server 0.94.14 - Access to arbitrary files as privileges Title: Vulnerability in BOA Webserver 0.94.14 Date: 20-06-2017 Status: Vendor contacted, patch available Scope: Arbitrary file access Platforms: Unix Author: Miguel Mendez Z Vendor...

BOA Web Server 0.94.14rc21 - Arbitrary File Access

BOA Web Server 0.94.14 - Access to arbitrary files as privileges Title: Vulnerability in BOA Webserver 0.94.14 Date: 20-06-2017 Status: Vendor contacted, patch available Scope: Arbitrary file access Platforms: Unix Author: Miguel Mendez Z Vendor Homepage: http://www.boa.org Version: Boa Webserver...