CVE-2019-12901

Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an unprivileged directory, leading to Privilege escalation...

CVE-2019-12903

Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as pert of the error message, exposing sensitive information...

CVE-2019-12902

Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data...

Format string

Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as pert of the error message, exposing sensitive information...

Input validation

Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data...

Privilege escalation

Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an unprivileged directory, leading to Privilege escalation...

CVE-2019-12903

CVE-2019-12903 affects Pydio Cells prior to 1.5.0. When a Name field is supplied in an unexpected Unicode format, the system mishandles the input and includes the database column/table name in the error message, leading to information disclosure. Practical impact: exposure of underlying database ...

CVE-2019-12903

Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as pert of the error message, exposing sensitive information...

CVE-2019-12902

Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data...

CVE-2019-12902

Pydio Cells vulnerable before version 1.5.0. The issue is incomplete cleanup of a user’s data on deletion, allowing a new user with the same User ID to recover the deleted user’s data. Affected platform: Pydio Cells prior to 1.5.0; root cause: data cleanup gap during deletion. Impact: potential i...

CVE-2019-12901

Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an unprivileged directory, leading to Privilege escalation...

CVE-2019-12901

Pydio Cells (before version 1.5.0) contains an input handling flaw where '../../' path elements are not neutralized, enabling a user with minimal privileges to upload or delete files in an unprivileged directory and thus escalate privileges. The issue is documented across multiple sources (NVD, R...

CVE-2018-15755

Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server...

CVE-2018-15755

Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server...

Description of the security update for Excel 2016: September 11, 2018

None None...

Cells Blog Cross-Site Scripting Vulnerability (CNVD-2018-00086)

Cells Blog is a free but powerful mini blogging system. A cross-site scripting vulnerability exists in Cells Blog 3.5. An attacker can exploit this vulnerability via the pubreadpost.php fmid parameter to conduct a cross-site scripting attack...

Cells Blog SQL Injection Vulnerability

Cells Blog is a free but powerful mini blogging system. Cells Blog 3.5 suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability by using the pubreadpost.php ptid parameter to conduct a SQL injection attack...

Cells Blog Cross-Site Scripting Vulnerability

Cells Blog is a free but powerful mini blogging system. A cross-site scripting vulnerability exists in Cells Blog 3.5. An attacker can exploit this vulnerability by using the jfdname parameter in the act=showpic request to conduct a cross-site scripting attack...

Cross site request forgery (csrf)

Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request...

CVE-2017-17948

Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request...