55 matches found
airVision NVR path Parameter Traversal Arbitrary File Access
The remote web server hosts airVision NVR, an application used to remotely monitor IP cameras. The installed version of airVision NVR fails to properly sanitize user-supplied input to the 'path' parameter of the 'views/file.php' script. This could allow an unauthenticated, remote attacker to read...
Webmin edit_html.cgi file Parameter Traversal Arbitrary File Access
This module exploits a directory traversal in Webmin 1.580. The vulnerability exists in the edithtml.cgi component and allows an authenticated user with access to the File Manager Module to access arbitrary files with root privileges. The module has been tested successfully with Webmin 1.580 over...
A Page Flip Book 2.3 - index.php pageflipbook_language Parameter Traversal Local File Inclusion
The A Page Flip Book WordPress plugin was affected by an index.php pageflipbooklanguage Parameter Traversal Local File Inclusion security vulnerability...
JSPWiki Edit.jsp editor Parameter Traversal Local File Inclusion
The remote web server hosts JSPWiki, an open source WikiWiki engine built using standard J2EE components. The installed version of JSPWiki fails to sanitize user input to the 'editor' parameter of the 'Edit.jsp' script of directory traversal sequences before using it to include and execute an...
PhpGedView module.php pgvaction Parameter Traversal Local File Inclusion
The web server hosts PhpGedView, a web-based real estate listing management application written in PHP. The version of PhpGedView installed on the remote host fails to sanitize user input to the 'pgvaction' parameter of the 'module.php' script before using it to include PHP code. Regardless of...
Open-Realty index.php select_users_lang Parameter Traversal Local File Inclusion
The web server hosts Open-Realty, a web-based real estate listing management application written in PHP. At least one install of Open-Realty on the remote host fails to sanitize user-supplied input to the 'selectuserslang' parameter in POST requests to the 'index.php' script before using it to...
Open-AudIT include_lang.php language Parameter Traversal Local File Inclusion
The web server hosts Open-AudIT, an open source network auditing application written in PHP. At least one install of Open-AudIT on the remote host fails to sanitize user-supplied input to the 'language' parameter before using it in 'includelang.php' to include PHP code. Regardless of PHP's...
OpenX fc.php MAX_type Parameter Traversal Local File Inclusion
The remote host is running OpenX formerly Openads, an open source ad serving application written in PHP. The installed version of OpenX does not validate user-supplied input to the 'MAXtype' parameter of the 'www/delivery/fc.php' script before using it in a PHP 'include' function. Regardless of...
ActualAnalyzer Lite style Parameter Traversal Local File Inclusion
The remote host is running ActualAnalyzer, a PHP-based tool for monitoring website traffic. The version of ActualAnalyzer installed on the remote host fails to sanitize user-supplied input to the 'style' parameter of the 'admin.php' script before using it to include PHP code. Regardless of PHP's...
Centreon include/doc/get_image.php 'img' Parameter Traversal Arbitrary File Access
The remote host is running Centreon or Oreon, a web-based network supervision program based on Nagios. The version of Centreon / Oreon installed on the remote host fails to sanitize user-supplied input to the 'img' parameter of the 'include/doc/getimage.php' script before using it to display the...
LifeType < 1.1.6 rss.php profile Parameter Traversal Arbitrary File Access
Binary data 3916.prm...
CakePHP vendors.php file Parameter Traversal Arbitrary File Access
The remote host is running CakePHP, an open source rapid development framework for PHP. The version of CakePHP on the remote host allows directory traversal sequences in the 'file' parameter of the 'js/vendors.php' script. An unauthenticated attacker may be able to leverage this flaw to view...
SAXoPRESS pbcs.dll url Parameter Traversal Arbitrary File Access
The remote host is running SAXoPRESS or Publicus, web content management systems commonly used by newspapers. The installation of SAXoPRESS / Publicus on the remote host fails to validate user input to the 'url' parameter of the 'apps/pbcs.dll' script. An attacker can exploit this issue to access...
HP Systems Insight Manager Namazu lang Parameter Traversal Arbitrary File Access
The remote host appears to be running HP Systems Insight Manager SIM, a unified infrastructure management tool. The version of HP SIM on the remote host includes a version of the search engine Namazu that reportedly fails to validate user input to the 'lang' parameter of the 'namazucgi' script. A...
RCBlog index.php post Parameter Traversal Arbitrary File Access
The remote host is running RCBlog, a blog written in PHP. The remote version of this software fails to sanitize user-supplied input to the 'post' parameter of the 'index.php' script. An attacker can use this to access arbitrary files on the remote host provided PHP's 'magicquotes' setting is...
Xaraya index.php module Parameter Traversal Arbitrary File/Directory Manipulation
The version of Xaraya installed on the remote host does not sanitize input to the 'module' parameter of the 'index.php' script before using it to write to files on the affected host. Using a specially crafted request, an unauthenticated attacker can create directories and possibly overwrite...
W-Agora < 4.2.1 index.php site Parameter Traversal Arbitrary File Access
Binary data 3171.prm...
Brio Unix odscgi HTMLFile Parameter Traversal Arbitrary File Access
The Brio web application interface has a directory traversal in the component 'odscgi'. An attacker may exploit this flaw to read arbitrary files on the remote host by submitting a URL like : http://www.example.com/ods-cgi/odscgi?HTMLFile=../../../../../../etc/passwd %NASLMINLEVEL 70300 This scri...
PerlDesk pdesk.cgi lang Parameter Traversal Arbitrary File Access
The remote host is running PerlDesk, a web-based help desk and email management application written in perl. There is a file inclusion issue in the remote version of this software which may allow an attacker to read fragments of arbitrary files on the remote host and to execute arbirary perl...