7353 matches found
CVE-2015-1306
The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors...
OpenStack Image Registry Delivery Service Arbitrary File Manipulation Vulnerability
The OpenStack Image Registry Delivery Service is an OpenStack project that stores, queries, and retrieves virtual machine images. An arbitrary file manipulation vulnerability exists in OpenStack Image Registry Delivery Service versions prior to 2014.1.4, and 2014.2.x versions prior to 2014.2.2,...
EMC M&R/ViPR SRM Directory Traversal Vulnerability
EMC M&R Watch4Net is an IT performance management application.EMC ViPR SRM is a storage resource management application. A directory traversal vulnerability exists in EMC M&R versions prior to 6.5u1 and ViPR SRM versions prior to 3.6.1, which allows remote authenticated users to read arbitrary...
UBUNTU-CVE-2013-6892
WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit...
CVE-2014-8790
GetSimple CMS 3.1.1–3.3.x (before 3.3.5 Beta 1) is affected by an XML External Entity (XXE) vulnerability in admin/api.php. The issue arises from passing unsanitized POST data to simplexml_load_string(), enabling an attacker to disclose arbitrary files via the data parameter. Impact is consistent...
N-Central Remote Support Manager 14.2.7.171 Code Execution Exploit
N-Central Remote Support Manager version 14.2.7.171 suffers from code execution via file upload and arbitrary file read vulnerabilities. Proof of concepts included. N-central Remote Support Manager Multiple Vulnerabilities Affected Versions: Verified in Version 14.2.7.171 PDF:...
ShopEx某两台服务器任意文件读取
简要描述： 偷师学艺 详细说明： 漏洞证明： http://122.144.135.187:8888/../../../../../../../../../../../../../../../../../etc/shadow http://121.196.44.117:8888/../../../../../../../../../../../../../../../../../etc/shadow...
Codiad path directory traversal vulnerability
Codiad is an open source Web-based IDE application for writing and editing code online. A directory traversal vulnerability exists in Codiad components/filemanager/download.php, which allows an attacker to read the contents of arbitrary files via the path parameter...
mcms v3.1.0 sql注入+任意文件读取。
简要描述： rt。打包 详细说明： app/weixin/notify.php $wx=new weixin; if$wx-checksignature //用于更改通知地址 ifisset$GET"echostr" die$GET"echostr"; //被动响应消息和事件 responsemsg; function responsemsg global $dbm,$C; $postStr = $GLOBALS"HTTPRAWPOSTDATA"; if!empty$postStr $postObj = simplexmlloadstring$postStr,...
WordPress Plugin Cart66 Lite 'models/Cart66.php' Directory Traversal Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A directory traversal vulnerability exists in WordPress plugin Cart66 Lite 'models/Cart66.php' versions prior to 1.5.4, which...
Ipswitch WhatsUp Gold Directory Traversal Vulnerability
Ipswitch WhatsUp Gold is a Windows-based network monitoring application. Ipswitch WhatsUp Gold suffers from a directory traversal vulnerability that could allow a remote attacker to read arbitrary files via an RRQ operation in the file name field...
CVE-2011-5310
Wikipad 1.6.0 is affected by a directory traversal in pages.php that lets remote attackers read arbitrary files via a .. in the id parameter. The root cause is improper path handling in the PHP script, enabling access to filesystem locations outside the intended directory. Publicly provided refer...
ECStore开源网店系统任意文件读取漏洞
简要描述： 后台模板编辑功能可越权查看系统文件 详细说明： file参数对../未做过滤，导致可以跨目录读取文件 测试url：http://shop.xxx.com/index.php/shopadmin/index.php?app=site&ctl=adminthemewidget&act=preview&theme=ecstore&file=../../../../../etc/passwd 漏洞证明：...
Direct Web Remoting (DWR) vulnerable to XML external entity injection
Overview Direct Web Remoting DWR is a Java framework for developing Ajax into web applications. DWR contains an XML external entity injection vulnerability CWE-611. Takeshi Terada of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer...
Design/Logic Flaw
The AdminUI in Trend Micro InterScan Web Security Virtual Appliance IWSVA before 6.0 HF build 1244 allows remote authenticated users to read arbitrary files via vectors related to configuration input when saving filters...
CVE-2013-1641
Directory traversal vulnerability in the zip download functionality in QuiXplorer before 2.5.5 allows remote attackers to read arbitrary files via a .. dot dot in the selitems parameter in a downloadselected action to index.php...
CVE-2014-4374
CVE-2014-4374 affects NSXMLParser in Foundation on Apple iOS before 8 and OS X Foundation. The flaw arises from an XML External Entity (XXE) handling issue where external entities can be resolved, enabling an attacker to read arbitrary files via XML data containing an external entity declaration....
IBM 1754 GCM KVM Multiple Vulnerabilities
Exploit for windows platform in category remote exploits Product description The IBM 1754 GCM family provides KVM over IP and serial console management technology in a single appliance. Versions v1.20.0.22575 and prior are vulnerables. Note that this vulnerability is also present in some DELL and...
Cisco NX-OS Arbitrary File Read Vulnerability (CSCul23419)
A vulnerability in the command-line interface CLI of Cisco NX-OS Software could allow an authenticated, local attacker to access the contents of arbitrary files on the affected device. Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, an...