Caldera 'cdir' Parameter Absolute Path Directory Traversal

The Caldera installation on the remote host contains a PHP script that is affected by a directory traversal vulnerability. A remote, unauthenticated attacker can exploit this issue by sending a crafted request to the '/dirmng/index.php' script, allowing access to arbitrary directories on the remo...

CVE-2014-2933: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in dirmng/index.php in Caldera 9.20 allows remote attackers to access arbitrary directories via a crafted pathname...

PT-2014-4963

Name of the Vulnerable Software and Affected Versions Caldera version 9.20 Description A directory traversal issue exists, allowing remote attackers to access arbitrary directories by providing a crafted pathname in dirmng/index.php. Recommendations For Caldera version 9.20, update the...

CVE-2014-2936: Improper Control of Generation of Code

The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via 1 the maindirhotfolder parameter to dirmng/index.php, or an unspecified parameter to 2 PPD/index.php, 3 dirmng/docmd.php, or 4 dirmng/param.php...

PT-2014-4966

Name of the Vulnerable Software and Affected Versions Caldera version 9.20 Description The issue allows remote attackers to conduct variable-injection attacks in the global scope. This can be achieved via the maindir hotfolder parameter to "dirmng/index.php", or an unspecified parameter to...