CVE-2018-12939

A directory traversal flaw in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows an authenticated attacker to write to or potentially delete arbitrary files via a .. dot dot in the "op/op.UploadChunks.php" "qquuid" parameter. NOTE: this can be leveraged to execute arbitrary code by using...

Directory traversal

A directory traversal flaw in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows an authenticated attacker to write to or potentially delete arbitrary files via a .. dot dot in the "op/op.UploadChunks.php" "qquuid" parameter. NOTE: this can be leveraged to execute arbitrary code by using...

CVE-2018-12939

SeedDMS (formerly LetoDMS/MyDMS) is vulnerable to a directory traversal flaw in op/op.UploadChunks.php that allows an authenticated attacker to write/delete arbitrary files. Affected versions are SeedDMS prior to 5.1.8; 5.1.8 fixes the issue. The vulnerability stems from unsafely handling the qqu...

CVE-2018-12939

A directory traversal flaw in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows an authenticated attacker to write to or potentially delete arbitrary files via a .. dot dot in the "op/op.UploadChunks.php" "qquuid" parameter. NOTE: this can be leveraged to execute arbitrary code by using...

GLSA-201807-03 : ZNC:Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201807-03 ZNC:Multiple Vulnerabilities Multiple vulnerabilities have been discovered in ZNC. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could read arbitary files and esclate...

Debian: Security Advisory (DSA-4259-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a crafted index.php?s=Admin-Tpl-ADD-id request, related to Lib/Common/Admin/function.php...

CVE-2018-14685

The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a crafted index.php?s=Admin-Tpl-ADD-id request, related to Lib/Common/Admin/function.php...

CVE-2016-9595

A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files...

CVE-2018-0617

Directory traversal vulnerability in ChamaNet MemoCGI v2.1800 to v2.2200 allows remote attackers to read arbitrary files via unspecified vectors...

Directory traversal

Directory traversal vulnerability in ChamaNet MemoCGI v2.1800 to v2.2200 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2018-0617

Directory traversal vulnerability in ChamaNet MemoCGI v2.1800 to v2.2200 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2018-0617

CVE-2018-0617 concerns a directory traversal in ChamaNet MemoCGI versions 2.1800–2.2200 . Multiple sources confirm that a remote attacker can read arbitrary files on the server via unspecified vectors. The vulnerability is caused by improper path handling in MemoCGI, enabling unauthorized file ac...

GHSA-X26F-26QW-HHHX Path Traversal in hekto

Versions of hekto before 0.2.3 are vulnerable to path traversal. This allows a remote attacker to read content of arbitrary files. Recommendation Update to version 0.2.3 or later...

Path Traversal in hekto

Versions of hekto before 0.2.3 are vulnerable to path traversal. This allows a remote attacker to read content of arbitrary files. Recommendation Update to version 0.2.3 or later...

The vulnerability of the Open Systems Gateway initiative software interface allows a perpetrator to connect to the interface and gain access to arbitrary files. This vulnerability is associated with the Cisco Policy Suite software.

The vulnerability of the OSGi interface in the Cisco Policy Suite software management environment is related to the absence of a mechanism for authenticating the OSGi interface. Exploiting this vulnerability allows an attacker to connect to the interface remotely and gain access to any files...

unzipper path traversal vulnerability

The unzipper npm library is a Node.js-based package for cross-platform compression. A path traversal vulnerability exists in unzipper npm library versions prior to 0.8.13. The vulnerability can be exploited to write arbitrary files via specially crafted zip archives with directory traversal names...

CVE-2018-1002204

adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

CVE-2018-1002205

DotNetZip.Semvered before 1.11.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

CVE-2018-1002206

SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...