WK+shop mall system has arbitrary file deletion vulnerability

WK+shop is a mall system based on the technology of PHP+MySQL, developed using ThinkPHP5.0 framework, which combines the Witcott mission system with multiple mall systems. WK+shop Universal Mall System has an arbitrary file deletion vulnerability, an attacker can delete arbitrary files on disk by...

IBM Cúram Social Program Management Cross-Site Scripting Vulnerability (CNVD-2017-33074)

IBM Curam Social Program Management SPM is a suite of social program management solutions from IBM USA. The solution supports the process of end-to-end social program delivery. A cross-site scripting vulnerability exists in IBM Curam SPM. A remote attacker could exploit this vulnerability to inje...

Directory traversal

Directory Traversal on Tenda W15E devices before 15.11.0.14 allows remote attackers to read unencrypted files via a crafted URL...

CVE-2017-14514

Directory Traversal on Tenda W15E devices before 15.11.0.14 allows remote attackers to read unencrypted files via a crafted URL...

Cisco Unified Intelligence Center Cross-Site Scripting Vulnerability (CNVD-2017-32526)

Cisco Unified Intelligence Center is the United States Cisco Cisco company's set of Web-based reporting platform. The platform provides a comprehensive display of report-related business data and call center data and other functions. A cross-site scripting vulnerability exists in the web interfac...

phpFileManager Arbitrary Command Execution Vulnerability

phpFileManager is the complete file system management tool. A security vulnerability exists in the implementation of phpFileManager 0.9.8, which can be exploited by remote attackers to execute arbitrary commands via a constructed URL...

CVE-2015-5958

phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL...

Design/Logic Flaw

phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL...

CVE-2015-5958

phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL...

CVE-2017-1440

IBM Emptoris Services Procurement 10.0.0.5 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable Web server. IBM...

Fedora 26 : git (2017-b1b3ae6666)

Resolve an arbitrary code execution vulnerability via crafted 'ssh://' URL CVE-2017-1000117. From the release announcement : A malicious third-party can give a crafted 'ssh://...' URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's...

Fedora 25 : git (2017-8ba7572cfd)

Resolve an arbitrary code execution vulnerability via crafted 'ssh://' URL CVE-2017-1000117. From the release announcement : A malicious third-party can give a crafted 'ssh://...' URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's...

USN-3387-1 git vulnerability

Brian Neel, Joern Schneeweisz, and Jeff King discovered that Git did not properly handle host names in 'ssh://' URLs. A remote attacker could use this to construct a git repository that when accessed could run arbitrary code with the privileges of the user...

CVE-2017-7675

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL...

Cisco Ultra Services Framework Information Disclosure Vulnerability

Cisco Ultra Services Framework is an intelligent online service delivery platform from the U.S. company Cisco Cisco. An information disclosure vulnerability exists in the AutoVNF VNFStagingView class in Cisco Ultra Services Framework version 21.0.0, which stems from the program failing to...

Directory traversal

Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally inaccessible files via a .. dot dot in a crafted URL...

CVE-2015-1847

Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally inaccessible files via a .. dot dot in a crafted URL...

REDDOXX Appliance Cross Site Scripting

Advisory: Cross-Site Scripting in REDDOXX Appliance RedTeam Pentesting discovered a cross-site scripting XSS vulnerability in the REDDOXX appliance software, which allows attackers to inject arbitrary JavaScript code via a crafted URL. Details ======= Product: REDDOXX Appliance Affected Versions:...

CVE-2017-10993

Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal...

Belkin N750 Router Command Injection

The remote Belkin router is affected by a remote command injection vulnerability due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted URL, to execute arbitrary commands on the device. Note that Nessus has detected this...