SysAid Help Desk Directory Traversal Vulnerability

SysAid Help Desk is a suite of Web-based IT management software. The SysAid Help Desk /sysaid/getGfiUpgradeFile URI and /sysaid/calculateRdsFileChecksum URI fails to adequately filter the 'fileName' parameter, allowing remote attackers to exploit a vulnerability to submit a special directory...

Novell ZENworks Configuration Management FileViewer Information Disclosure (CVE-2015-0783)

An information disclosure vulnerability exists in Novell ZENworks Configuration Management. The vulnerability is due to lack of sanitization on the filename parameter within the FileViewer class. By sending crafted requests to the target server, a remote attacker can leverage this vulnerability t...

Path traversal

Absolute path traversal vulnerability in SysAid On-Premise before 14.4.2 allows remote attackers to read arbitrary files via a \\ four backslashes in the fileName parameter to getRdsLogFile...

Directory traversal

Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. dot dot in the FILENAME parameter...

Directory traversal

Directory traversal vulnerability in ZOHO ManageEngine Desktop Central DC before 9 build 90055 allows remote attackers to execute arbitrary code via a .. dot dot in the fileName parameter in an LFU action to statusUpdate...

CVE-2014-5006

Directory traversal vulnerability in ZOHO ManageEngine Desktop Central DC before 9 build 90055 allows remote attackers to execute arbitrary code via a .. dot dot in the fileName parameter to mdm/mdmLogUploader...

CVE-2014-5006

CVE-2014-5006 affects ManageEngine Desktop Central/DC before 9 build 90055. A directory traversal in the mdmLogUploader servlet via a .. in the fileName parameter enables remote code execution. Affected component: mdmLogUploader handling in Desktop Central. Impact: arbitrary code execution on aff...

Design/Logic Flaw

Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream ADS syntax in the filename...

CVE-2014-2044

Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream ADS syntax in the filename...

Elxis 'filename' Parameter Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/37158/info Elxis is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that could ai...

KAPhotoservice search.asp filename Parameter XSS

No description provided by source...

UBUNTU-CVE-2013-2226

Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the 1 usersidassign parameter to ajax/ticketassigninformation.php, 2 filename parameter to front/document.form.php, or 3 table parameter to ajax/comments.php...

Directory traversal

Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a filename parameter containing directory traversal sequences...

CVE-2014-2864

Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a filename parameter containing directory traversal sequences...

ownCloud 'filename'参数远程代码执行漏洞

Bugtraq ID:66000 CVE ID:CVE-2014-2044 ownCloud是一款开源的私有云服务器。 ownCloud不正确过滤用户提交的'filename'参数数据，允许远程攻击者利用漏洞提交恶意POST请求执行任意代码。受影响脚本为： /owncloud/owncloud/?app=files&getfile=ajax%2Fupload.php POST 'filename' parameter 0 ownCloud 4.0.x ownCloud 4.5.x 厂商补丁： ownCloud ----- ownCloud 5.0已经修复该漏洞，建议用户下载更新：...

CVE-2013-5912

VhttpdMgr in Thomson Reuters Velocity Analytics Vhayu Analytic Server 6.94 build 2995 allows remote attackers to execute arbitrary code via a URL in the fileName parameter during an importFile action...

CVE-2013-2068

Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. dot dot in the filename parameter to the 1 log, 2 upload, or 3 linuxpkgs method...

Novell Messenger Client Filename Parameter Stack Buffer Overflow (CVE-2013-1085)

A stack buffer over flow has been reported in Novell Messenger client...

CVE-2013-0150

Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass 6.0.0 through 6.1.0 and 7.0.0, and other products "when APM is provisioned," allows remote attackers to upload and execut...

Directory traversal

Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass 6.0.0 through 6.1.0 and 7.0.0, and other products "when APM is provisioned," allows remote attackers to upload and execut...