CVE-2018-15684

An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory /include/logs using predictable file names, which can lead to full path disclosure and leakage of sensitive data...

CVE-2018-15684

CVE-2018-15684 concerns BTITeam XBTIT where PHP error logs are stored in an open directory (/include/logs) with predictable filenames, enabling full path disclosure and leakage of sensitive data. The vulnerability is described across multiple sources (NVD/NVD-variants) indicating exposure of log ...

Command Execution Vulnerability in OTCMS v3.53

Net Titanium Article Management System OTCMS is a simple and good asp article management system. A command execution vulnerability exists in OTCMS v3.53. An attacker can use the vulnerability to obtain website path information and write PHP code to gain server privileges...

CVE-2018-12990

phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrftokenvalue field...

CVE-2018-12536

CVE-2018-12536 affects Eclipse Jetty Server (9.x) when webapps use the DefaultServlet/Default Error handling. A specially crafted bad query targeting non-matching URLs can trigger java.nio.file.InvalidPathException during static file serving, and if the error handler reveals the exception message...

CVE-2018-12632

The CVE affects Redatam7 (formerly Redatam WebServer). Affected component: the rpwebutilities.exe/text endpoint, where an invalid LFN parameter enables remote attackers to discover the installation path, indicating a path-disclosure/directory-traversal type exposure. No exploit details or remedia...

Redatam Directory Traversal Vulnerability

Redatam is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:redatam:redatam"; if...

Path traversal

Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird 52.5.2...

CMS Made Simple Physical Path Disclosure Vulnerability (CNVD-2018-09058)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMSMS 2.2.7 and...

CVE-2018-10424

mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field...

CVE-2018-10424

mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field...

Path traversal

mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field...

CVE-2018-10424

MiniCMS 1.10 is affected. The vulnerability is in mc-admin/post-edit.php where a modified id field allows full path disclosure. The root cause is a path disclosure issue that leads to information exposure. Exploitation details and mitigations are not provided in the supplied documents.

CVE-2018-10424

mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field...

MiniCMS Information Disclosure Vulnerability

MiniCMS is a mini content management system CMS designed for personal websites. A security vulnerability exists in the mc-admin/post-edit.php file in MiniCMS version 1.10. An attacker can exploit the vulnerability by changing the id field to obtain the full path...

UBUNTU-CVE-2018-10245

A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682. The attack can, for example, use the awstats.pl framename and update parameters...

CVE-2018-10245

A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682. The attack can, for example, use the awstats.pl framename and update parameters...

CVE-2018-10245

A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682. The attack can, for example, use the awstats.pl framename and update parameters...

CVE-2018-10245

A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682. The attack can, for example, use the awstats.pl framename and update parameters...

DEBIAN-CVE-2018-10245

A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682. The attack can, for example, use the awstats.pl framename and update parameters...