CVE-2015-5468

Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter to includes/download.php...

Arbitrary file download vulnerability in the fileName parameter of GoodVision video conferencing system

GoodVision Video Conferencing System is a software application for pc platforms in Simplified Chinese language. There is an arbitrary file download vulnerability in the fileName parameter of GoodVision Video Conferencing System. This allows attackers to exploit the vulnerability to obtain sensiti...

PT-2017-9768 · Moxa · Moxa Awk-3131A Wireless Access Point

Name of the Vulnerable Software and Affected Versions: Moxa AWK-3131A Wireless Access Point version 1.1 Description: An exploitable null pointer dereference issue exists in the Web Application /forms/web runScript iw filename functionality. This can be triggered by an HTTP POST request with a bla...

Code injection

Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a 1 stderr.log or 2 stdout.log value in the filename parameter to /cmf/process//logs...

CVE-2016-4949

Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a 1 stderr.log or 2 stdout.log value in the filename parameter to /cmf/process//logs...

CVE-2016-4949: Exposure of Sensitive Information to an Unauthorized Actor

Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a 1 stderr.log or 2 stdout.log value in the filename parameter to /cmf/process/ /logs...

SQL Injection Vulnerability in the 'filename' parameter of Xinhoo Collaboration Office System

Xinhuo coworking system is an open source office system, cross-platform system, support APP, pc web version, pc client and so on. SQL injection vulnerability exists in the 'filename' parameter of Xinhao Co-working System. Allow attackers to exploit the vulnerability to obtain sensitive database...

CVE-2016-5840: Improper Input Validation

hotfixupload.cgi in Trend Micro Deep Discovery Inspector DDI 3.7, 3.8 SP1 3.81, and 3.8 SP2 3.82 allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header...

NTP ntpq Component Elevation of Privilege Vulnerability

NTP Network Time Protocol is a network protocol that synchronizes the clocks of two computers by exchanging packets. An elevation of privilege vulnerability exists in the ntpq component of NTP version 4.2.8p5, which can be exploited by a remote attacker to affect integrity by manipulating the...

Directory traversal

Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the fileName parameter...

CVE-2016-3972

Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the fileName parameter...

CVE-2016-3972: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the fileName parameter...

CVE-2016-3976

Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971. Recent assessments: Assessed Attacker Value: 0 Assessed...

Updated cgit packages fix security vulnerability

Reflected Cross Site Scripting and Header Injection in Mimetype Query String in cgit before 0.12 CVE-2016-1899. Stored Cross Site Scripting and Header Injection in Filename Parameter in cgit before 0.12 CVE-2016-1900. Integer Overflow resulting in Buffer Overflow in cgit before 0.12 CVE-2016-1901...

Xceedium Xsuite Cross-Site Scripting Vulnerability

Xceedium Xsuite is a unified identity management solution from Xceedium that provides access control, monitoring and logging capabilities for hybrid cloud environments. The solution supports access control policies based on roles or individual users. A cross-site scripting vulnerability exists in...

Cross site scripting

Cross-site scripting XSS vulnerability in ajaxcmd.php in Xceedium Xsuite 2.4.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the fileName parameter...

CVE-2015-4665: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ajaxcmd.php in Xceedium Xsuite 2.4.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the fileName parameter...

CollabNet Subversion Edge tail local file inclusion

Vuln Title: Local file inclusion in CollabNet Subversion Edge Management Frontend via logfile "fileName" parameter of the "tail" action Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type: Local...

CollabNet Subversion Edge Management downloadHook LFI

Vuln Title: Local file inclusion in CollabNet Subversion Edge Management Frontend via logfile "filename" parameter of the "downloadHook" action Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type:...

SysAid Help Desk Directory Traversal Vulnerability

SysAid Help Desk is a suite of Web-based IT management software. The SysAid Help Desk /sysaid/getGfiUpgradeFile URI and /sysaid/calculateRdsFileChecksum URI fails to adequately filter the 'fileName' parameter, allowing remote attackers to exploit a vulnerability to submit a special directory...