CVE-2018-12990

phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrftokenvalue field...

CVE-2018-12990

phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrftokenvalue field...

Code injection

Redatam7 formerly Redatam WebServer allows remote attackers to discover the installation path via an invalid LFN parameter to the /redbin/rpwebutilities.exe/text URI...

CVE-2018-12632

Redatam7 formerly Redatam WebServer allows remote attackers to discover the installation path via an invalid LFN parameter to the /redbin/rpwebutilities.exe/text URI...

Path traversal

Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php...

CVE-2018-7662

CVE-2018-7662 affects CouchCMS <= 2.0, enabling remote attackers to disclose the server’s full directory path by directly requesting includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php. This path disclosure arises from a missing/insufficient input validation in the affected end...

CVE-2018-7479

YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php...

Path traversal

zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qqconnect2.0/API/class/ErrorCase.class.php or 3/ucenterapi/code/friend.php...

PT-2018-18068 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: The issue allows remote attackers to discover the full path via a direct request to "3/qq connect2.0/API/class/ErrorCase.class.php" or "3/ucenter api/code/friend.php". Recommendations: For zzcms version 8.2, as ...

CVE-2018-6910

DedeCMS 5.7 is affected by CVE-2018-6910, a path-disclosure vulnerability that allows remote attackers to discover the full server path by requesting include/downmix.inc.php or inc/inc_archives_functions.php. The issue enables information disclosure that can aid further attacks. The Nuclei templa...

Code injection

EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php...

CVE-2018-6881

EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php...

Design/Logic Flaw

viewallbugpage.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filterensurevalidfilter call in currentuserapi.php...

CVE-2015-7934

The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors...

CVE-2015-7934

The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors...

Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/2503/info Apache HTTPD is the Apache Web Server, freely distributed and actively maintained by the Apache Software Foundation. It is a freely available and widely used software package, included with various implementatio...

Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/2503/info Apache HTTPD is the Apache Web Server, freely distributed and actively maintained by the Apache Software Foundation. It is a freely available and widely used software package, included with various implementatio...

Datei Upload Script v 1.09 Remote file upload Vulnerability

Exploit for php platform in category web applications =========================================================== Datei Upload Script v 1.09 Remote file upload Vulnerability =========================================================== InformatioN Title? ?? : Datei Upload Script v 1.09 Remote file...

Design/Logic Flaw

viewalbum.php in SelectaPix 1.31 and earlier allows remote attackers to obtain the installation path via a certain request, which displays the path in an error message, possibly due to an invalid or missing parameter...

Debian DSA-067-1 : apache - Remote exploit

We have received reports that the apache' package, as included in the Debian stable' distribution, is vulnerable to the artificially long slash path directory listing vulnerability' as described on SecurityFocus. This vulnerability was announced to bugtraq by Dan Harkless. Quoting the SecurityFoc...