CVE-2018-1199

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

CVE-2017-17876

Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter...

CVE-2017-17876: Undefined Security Weakness

Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter...

PT-2017-15065

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System version 3.0 Description The issue allows remote attackers to bypass intended file-read restrictions. This can be achieved via a user=download request with a pathname in the path parameter...

CVE-2017-11511

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...

CVE-2017-11152

Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter...

Directory traversal

Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter...

CVE-2017-11152

Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter...

DzzOffice v1.3.1 Arbitrary File Download Vulnerability in Frontend

DzzOffice is a cloud storage management tool , based on the free open source release , can be used as a personal network disk , team , enterprise network disk for use . DzzOffice v1.3.1 front-end arbitrary file download vulnerability exists due to the program fails to share path parameter for...

PT-2017-11777

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.7.3-3432 Synology Photo Station versions prior to 6.3-2967 Description The issue allows remote attackers to write arbitrary files via the path parameter in PixlrEditorHandler.php. Recommendations For...

PT-2017-6684

Name of the Vulnerable Software and Affected Versions phpMyBackupPro versions prior to 2.5 Description The issue allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to "scheduled.php", and making requests to injected...

PT-2017-6660

Name of the Vulnerable Software and Affected Versions Etherpad versions 1.1.1 through 1.5.2 Description The issue allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests, such as "/api/" endpoints...

MODX Revolution 'setup/templates/findcore.php' file remote code execution vulnerability

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A security vulnerability exists in the setup/templates/findcore.php file in MODX Revolution 2.5.4-pl and...

PT-2017-9086

Name of the Vulnerable Software and Affected Versions Plone CMS versions 4.2.x through 4.3.11 Plone CMS versions 5.x through 5.0.6 Description The issue allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in a getFile action to the...

Cross site scripting

groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php path parameter...

CVE-2017-6480

groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php path parameter...

CVE-2017-6480

groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php path parameter...

CVE-2017-6480

groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php path parameter...

CVE-2017-6480: Improper Neutralization of Input During Web Page Generation

groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php path parameter...

PT-2017-17097

Name of the Vulnerable Software and Affected Versions groovel/cmsgroovel versions prior to 3.3.7-beta Description The issue is related to a reflected XSS in the commons/browser.php file, specifically affecting the path parameter. Recommendations For versions prior to 3.3.7-beta, update to version...