Cross site scripting

Pydio version 8.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated remote attacker manipulating...

Remote code execution

Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution RCE vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow$nodeObject that can result in An attacker gaining admin access and can then execute arbitrary commands on the...

CVE-2018-1999016

Pydio version 8.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated remote attacker manipulating...

CVE-2018-1999018

Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution RCE vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow$nodeObject that can result in An attacker gaining admin access and can then execute arbitrary commands on the...

CVE-2018-1999016

Pydio version 8.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated remote attacker manipulating...

CVE-2018-1999018

Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution RCE vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow$nodeObject that can result in An attacker gaining admin access and can then execute arbitrary commands on the...

CVE-2018-1999016

CVE-2018-1999016 affects Pydio 8.2.0 and earlier, with a Cross Site Scripting vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php (line 48) and ./core/vendor/dapphp/securimage/examples/test.mysql.static.php (lines 114, 118). An unauthenticated remote attacker could manipula...

CVE-2018-1999017

Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery SSRF vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath$url that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appear...

CVE-2018-1999018

CVE-2018-1999018 affects Pydio v8.2.1 and earlier. The root cause is unvalidated user input in the AntivirusScanner.php (plugins/action.antivirus/AntivirusScanner.php) function scanNow($nodeObject), enabling Remote Code Execution. The vulnerability can allow an attacker with access to edit the An...

CVE-2018-1999016

Pydio version 8.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated remote attacker manipulating...

CVE-2018-1999017

Pydio 8.2.0 and earlier contains a Server-Side Request Forgery (SSRF) in plugins/action.updater/UpgradeManager.php at line 154 (getUpgradePath($url)). An authenticated admin can cause the server to request arbitrary URLs by entering a URL into the Upgrade Engine and reloading. The issue is mitiga...

Pydio Core Detection (HTTP)

HTTP based detection of Pydio Core. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.113003";...

Pydio Core < 6.0.7 Multiple Vulnerabilities

Pydio Core is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:pydio:pydio"; if description...

CVE-2015-3431

Pydio formerly AjaXplorer before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities."...

Command injection

Pydio formerly AjaXplorer before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities."...

CVE-2015-3432

Multiple cross-site scripting XSS vulnerabilities in Pydio formerly AjaXplorer before 6.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Pydio XSS Vulnerabilities."...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Pydio formerly AjaXplorer before 6.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Pydio XSS Vulnerabilities."...

CVE-2015-3431

Pydio Core (formerly AjaXplorer)

CVE-2015-3432

Multiple cross-site scripting XSS vulnerabilities in Pydio formerly AjaXplorer before 6.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Pydio XSS Vulnerabilities."...

CVE-2015-3431

Pydio formerly AjaXplorer before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities."...