CVE-2016-6601

Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. dot dot in the fileName parameter to servlets/FetchFile...

Format string

The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file...

Xxe

XML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote authenticated users to read arbitrary files by creating a new HTTP XML/REST Value sensor that accesses a crafted XML file...

CVE-2015-7743

XML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote authenticated users to read arbitrary files by creating a new HTTP XML/REST Value sensor that accesses a crafted XML file...

CVE-2015-8860

The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive...

CVE-2015-7743

XML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote authenticated users to read arbitrary files by creating a new HTTP XML/REST Value sensor that accesses a crafted XML file...

CVE-2015-8860

The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive...

CVE-2015-7743

CVE-2015-7743 concerns Paessler PRTG Network Monitor. The vulnerability is an XML External Entity (XXE) expansion flaw in which authenticated users who can create a new HTTP XML/REST Value sensor can read arbitrary files on the PRTG host by supplying crafted XML. Affected versions: before 16.2.23...

Information disclosure

Remote Manager in Open Enterprise Server OES allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows complete directory traversal and total information disclosure. This vulnerability is present on all versions of OES for linux, it applies to...

CVE-2017-5182

Remote Manager in Open Enterprise Server OES allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows complete directory traversal and total information disclosure. This vulnerability is present on all versions of OES for linux, it applies to...

CVE-2016-6253

mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbitrary files on the target system via a symlink attack on the user mailbox...

CVE-2016-10143

A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field...

Directory traversal

Directory traversal vulnerability in template/usererror.missingextension.php in Symphony CMS before 2.6.10 allows remote attackers to rename arbitrary files via a .. dot dot in the existing-folder and new-folder parameters...

CVE-2017-5541

Directory traversal vulnerability in template/usererror.missingextension.php in Symphony CMS before 2.6.10 allows remote attackers to rename arbitrary files via a .. dot dot in the existing-folder and new-folder parameters...

CVE-2016-10143

CVE-2016-10143 affects Tiki Wiki CMS Groupware/Tiki Wiki CMS 15.2, where a remote attacker can read arbitrary files by supplying a crafted pathname in a banner URL field. The underlying issue is an arbitrary file disclosure vulnerability in the banner URL handling, enabling access to local system...

CVE-2017-5541

Directory traversal vulnerability in template/usererror.missingextension.php in Symphony CMS before 2.6.10 allows remote attackers to rename arbitrary files via a .. dot dot in the existing-folder and new-folder parameters...

CVE-2017-5541

Symphony CMS before 2.6.10 is affected by a directory traversal vulnerability in template/usererror.missing_extension.php that allows remote attackers to rename arbitrary files via a .. (dot dot) in the existing-folder and new-folder parameters. Root cause: insufficient validation of directory tr...

WordPress Plugin WooCommerce Local File Inclusion Vulnerability

WordPress is a free and open source blogging software and content management system based on PHP and MySQL platform.WooCommerce is wordpress e-commerce plugin. A local file inclusion vulnerability exists in the WordPress plugin WooCommerce, which can be exploited by an attacker to directly downlo...

CVE-2016-5725

Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ dot dot backslash in a response to a recursive GET command...

CVE-2016-5725

Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ dot dot backslash in a response to a recursive GET command...