CVE-2017-18687

Technical details (affected product/version, root cause, impact, or fixes) are not publicly provided in the connected documents. Monitor for updates; current sources summarize the issue but do not offer actionable specifics.

jetty: error path information disclosure

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches...

BWA DiREX-Pro Path Disclosure Vulnerability

BWA Technology DiREX-Pro is a network video recorder from BWA Technology, Germany. A security vulnerability exists in BWA Technology DiREX-Pro version 1.2181. An attacker can exploit the vulnerability by sending an invalid 'name' parameter to the valsoft.php3 file to obtain the full path...

CVE-2020-10249

BWA DiREX-Pro 1.2181 devices allow full path disclosure via an invalid name array parameter to valsoft.php3...

CVE-2020-10249

BWA DiREX-Pro 1.2181 devices allow full path disclosure via an invalid name array parameter to valsoft.php3...

Path traversal

BWA DiREX-Pro 1.2181 devices allow full path disclosure via an invalid name array parameter to valsoft.php3...

CVE-2020-10249

BWA DiREX-Pro 1.2181 devices allow full path disclosure via an invalid name array parameter to valsoft.php3...

CVE-2020-10249

CVE-2020-10249 affects BWA DiREX-Pro 1.2181 devices. A vulnerability in the val_soft.php3 component allows full path disclosure via an invalid name array parameter, exposing the filesystem path and compromising confidentiality. The issue is described across multiple sources as a path traversal-st...

Engel & Völkers Technology GmbH: full path disclosure on world.engelvoelkers.com via error messages

Webserver in world.engelvoelkers.com discloses internal path in it's error message Via a browser: http://world.engelvoelkers.com/config/app.php http://world.engelvoelkers.com/connect.php Impact There is no direct impact, however this information can help an attacker identify other vulnerabilities...

CVE-2019-19993

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even with no authentication, may simply send arbitrary content to the vulnerable pages to generate error messages that expose some full paths...

CVE-2019-19993

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even with no authentication, may simply send arbitrary content to the vulnerable pages to generate error messages that expose some full paths...

Path traversal

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even with no authentication, may simply send arbitrary content to the vulnerable pages to generate error messages that expose some full paths...

CVE-2019-19993

Selesta Visual Access Manager (VAM) 4.15.0–4.29.x contains a full path disclosure vulnerability. An unauthenticated attacker can send arbitrary content to vulnerable pages, causing error messages that reveal full filesystem paths. Impact described as confidentiality exposure (partial). Root cause...

CVE-2019-19993

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even with no authentication, may simply send arbitrary content to the vulnerable pages to generate error messages that expose some full paths...

CVE-2019-4745

IBM Maximo Asset Management 7.6.1.0 could allow a remote attacker to disclose sensitive information to an authenticated user due to disclosing path information in the URL. IBM X-Force ID: 172883...

CVE-2019-4745

CVE-2019-4745 affects IBM Maximo Asset Management core 7.6.1.0. Root cause: path information disclosure in the URL leading to potential sensitive data exposure to an authenticated user. CVSS base score 4.3 (MEDIUM). Remediation: apply fixes for 7.6.1.0 (e.g., 7.6.1.0 iFix015 or latest Interim Fix...

SmartClient Absolute Path Information Disclosure Vulnerability

smartclient is an enterprise ajax framework , including very good UI library , tool library and client-server data binding and other features . An absolute path information disclosure vulnerability exists in SmartClient 12.0. An unauthenticated attacker can exploit this vulnerability by sending a...

CVE-2020-9351

Summary of vulnerability (CVE-2020-9351) : In SmartClient 12.0, an unauthenticated attacker can send a POST to /tools/developerConsoleOperations.jsp or /isomorphic/IDACall with malformed XML in the _transaction parameter, causing the server to return a verbose error that reveals the absolute path...

CVE-2013-2624

Telean before 1.3.1 contains a full path disclosure vulnerability which could allow remote attackers to obtain sensitive information through a specially crafted URL request...

CVE-2013-2631

TinyWebGallery TWG 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters "twgbrowserx" and "twgbrowsery" in the page image.php...