taoCMS V2.5Beta5 has arbitrary file reading vulnerability

TAOCMS is the smallest fully functional CMS management system in China based on php+sqlite/mysql. taoCMS V2.5Beta5 has an arbitrary file reading vulnerability, which can be exploited by an attacker to read, download and edit all files of the site...

CVE-2017-9000

ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An...

Design/Logic Flaw

ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An...

CVE-2017-9000

CVE-2017-9000 affects ArubaOS on multiple branches (pre-6.3.1.25, pre-6.4.4.16, pre-6.5.1.9/6.5.2/6.5.3/6.5.4, and pre-8.1.0.4). It describes an unauthenticated arbitrary file access vulnerability that can be exploited by an unauthenticated attacker with network access to an Aruba Mobility Contro...

CVE-2017-9000

ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An...

USN-3730-1: LXC vulnerability

Matthias Gerstner discovered that LXC incorrectly handled the lxc-user-nic utility. A local attacker could possibly use this issue to open arbitrary files...

USN-3730-1 lxc vulnerability

Matthias Gerstner discovered that LXC incorrectly handled the lxc-user-nic utility. A local attacker could possibly use this issue to open arbitrary files...

File Inclusion Vulnerability in aitecms V1.0

Hainan Zanzan Network Technology Co., Ltd. is a network company in the industry that provides professional website construction, network service and operation technology output. aitecms V1.0 has a file inclusion vulnerability that can be exploited by attackers to access arbitrary files...

Directory Traversal

JavaServer Faces is vulnerable to directory traversal. A malicious user can access arbitrary files through loc parameters in the function ResourceManager.java:getLocalePrefix...

UBUNTU-CVE-2016-9487

EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf...

CVE-2016-9484 PHP FormMail Generator generates PHP code for standard web forms, and the code generated does not properly validate user input folder directories and is vulnerable to path traversal

The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server. The PHP FormMail Generator website does not use version numbers and is updated continuously. Any P...

CVE-2016-9484

The CVE-2016-9484 vulnerability in PHP FormMail Generator arises from generated PHP form code that does not properly validate user-supplied folder directories, enabling a remote unauthenticated attacker to perform path traversal and access arbitrary files on the server. The issue affects PHP form...

Dicoogle PACS 2.5.0 - Directory Traversal

Dicoogle PACS 2.5.0 - Directory Traversal Exploit Title: Dicoogle PACS 2.5.0 - Directory Traversal Date: 2018-05-25 Software Link: http://www.dicoogle.com/home Version: Dicoogle PACS 2.5.0-201712291522 Category: webapps Tested on: Windows 2012 R2 Exploit Author: Carlos Avila Contact:...

CVE-2018-14669

ClickHouse MySQL client had “LOAD DATA LOCAL INFILE” functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server. Andrey Krasichkov and Evgeny Sidorov of Yandex Information Security Team...

SUSE-SU-2018:1890-1 Security update for rubygem-yard

This update for rubygem-yard fixes the following issues: - CVE-2017-17042: The server in YARD did not block relative paths with an initial ../ sequence, which allowed attackers to conduct directory traversal attacks and read arbitrary files bsc1070263...

Mikrotik Winbox Arbitrary File Access Vulnerability

MikroTik RouterOS is a routing operating system, developed based on the Linux kernel, compatible with x86 PC routing software, through which a standard PC computer can be turned into a professional router.Winbox is a Windows-based software for remote management of RouterOS, providing an intuitive...

Augustine Path Traversal Vulnerability

augustine is a static HTTP server used in Node.js. A path traversal vulnerability exists in augustine, which stems from the program's lack of url validation. The vulnerability can be exploited by sending a specially crafted GET request to read the contents of an arbitrary file with a known path...

PT-2018-16151 · 626 · 626

Name of the Vulnerable Software and Affected Versions: 626 versions all Description: The issue is related to a Path Traversal vulnerability due to the lack of validation of files, which allows a malicious user to read the content of any file with a known path. This enables a remote attacker to re...

CVE-2018-11645

psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977...

Sitecore Sitecore.NET Log Viewer Application Path Traversal Vulnerability

Sitecore Sitecore.NET is Denmark Sitecore company based on a set of .NET web content management system. Log Viewer application is one of the log viewer application. A directory traversal vulnerability exists in the Log Viewer application in Sitecore Sitecore.NET 8.1 and earlier versions. An...