Directory traversal

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager SRM before 1.1.5-6542-4 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

Directory traversal

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology File Station before 1.1.1-0099 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

CVE-2017-15891

Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authenticated users to modify calendar event via unspecified vectors...

CVE-2017-15895

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager SRM before 1.1.5-6542-4 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

CVE-2017-15895

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager SRM before 1.1.5-6542-4 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

CVE-2017-15894

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager DSM 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

CVE-2017-15894

The CVE-2017-15894 entry affects Synology DiskStation Manager (DSM) via a directory traversal in the SYNO.FileStation.Extract component. Affected versions are DSM 6.0.x prior to 6.0.3-8754-3 and DSM 5.2-5967-6 and earlier. The vulnerability allows remote authenticated users to write arbitrary fil...

CVE-2017-15893

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology File Station before 1.1.1-0099 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

CVE-2017-15895

CVE-2017-15895 affects Synology Router Manager (SRM) 1.1.x, where the directory traversal vulnerability in SYNO.FileStation.Extract allows remote authenticated users to write arbitrary files via the dest_folder_path parameter. Impact expected: potential integrity loss on SRM file writes; no confi...

CVE-2017-17384

ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job...

CVE-2017-17384

ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job...

CVE-2017-17384

ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job...

ISPConfig Elevation of Privilege Vulnerability

ISPConfig is an open source web hosting management program for Linux with a Web control panel , you can use the Web control panel to manage web hosting , open a website , open a mailbox , open and manage mysql databases , support for DNS resolution and monitor the server's operating conditions an...

CVE-2017-17383

Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, as demonstrated by the JDK tool in Jenkins core and the Ant tool in the Ant plugin, aka SECURITY-624...

CVE-2017-15889

Command injection vulnerability in smart.cgi in Synology DiskStation Manager DSM before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field...

Command injection

Command injection vulnerability in smart.cgi in Synology DiskStation Manager DSM before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field...

[ASA-201712-2] cacti: multiple issues

Arch Linux Security Advisory ASA-201712-2 ========================================= Severity: High Date : 2017-12-02 CVE-ID : CVE-2017-16641 CVE-2017-16660 CVE-2017-16661 CVE-2017-16785 Package : cacti Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-537 Summary =====...

CVE-2017-16893

The application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and possibly prior. This vulnerability allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. tags.php is affected:...

BigTree CMS SQL Injection Vulnerability (2)

BigTree CMS is prone to an SQL injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:bigtreecms:bigtreecms";...

CVE-2017-15054

TeamPass before version 2.1.27.9 is affected by an arbitrary file upload vulnerability in upload.files.php. An authenticated attacker can tamper with request parameters to select a branch, upload an arbitrary file, and access that file to execute code on the server (Remote Command Execution). Aff...