GHSA-RW6J-RHW7-Q94C Directory Traversal in sly07

Affected versions of sly07 resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system. Example...

CVE-2018-14514

An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibly have unspecified other impact...

CVE-2018-14514

An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibly have unspecified other impact...

Server side request forgery (ssrf)

An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibly have unspecified other impact...

CVE-2018-14514

The CVE-2018-14514 issue affects idreamsoft iCMS, specifically V7.0.9, with a server-side request forgery (SSRF) flaw that can let an attacker read sensitive files or access an intranet. Related entries (CVE-2018-14858) confirm the underlying cause: the remote function in app/spider/spider_tools....

CVE-2018-14514

An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibly have unspecified other impact...

IBM Sterling File Gateway Information Disclosure Vulnerability (CNVD-2018-14088)

IBM Sterling File Gateway is a suite of file transfer software from IBM in the United States. The software integrates different centers of file transfer activity and facilitates the secure exchange of file-based data over the Internet. A security vulnerability exists in IBM Sterling File Gateway...

idreamsoft iCMS Server-Side Request Forgery Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A server-side request forgery vulnerability exists in idreamsoft iCMS version 7.0.9. An attacker can exploit the vulnerability to read sensitive files and access the intranet...

Cisco Policy Suite Local Information Disclosure Vulnerability

Cisco Policy Suite is a carrier-grade policy, charging, and subscriber data management solution. A local information disclosure vulnerability exists in the CLI of Cisco Policy Suite. The vulnerability stems from insufficient access control privileges. An attacker can exploit the vulnerability by...

CVE-2018-0392

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions i.e., World-Readable. An attacker could exploit this vulnerability by logging in to the CLI. An...

CVE-2018-0392

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions i.e., World-Readable. An attacker could exploit this vulnerability by logging in to the CLI. An...

Improper access control

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions i.e., World-Readable. An attacker could exploit this vulnerability by logging in to the CLI. An...

CVE-2018-0392

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions i.e., World-Readable. An attacker could exploit this vulnerability by logging in to the CLI. An...

Xinhuo Collaboration Office v1.7.8 has an arbitrary file download vulnerability

Xinhuo Co-operation Office System is an open source and cross-platform office system. Xinhao Collaboration Office System v1.7.8 has an arbitrary file download vulnerability, which can be exploited by attackers to download sensitive files...

File download vulnerability in OURPHP website builder v1.8.3

OURPHP is a brand, a PHP + MySQL development based on W3C standard building system. OURPHP website building system version V1.8.3 file download vulnerability, attackers can use the vulnerability to download sensitive files...

Arbitrary File Read Vulnerability in Metinfo Version 6.0.0 (Patch Bypass)

MetInfo is a content management system developed using PHP and Mysql. An arbitrary file read vulnerability exists in Metinfo version 6.0.0. An attacker can exploit the vulnerability to read sensitive files on a website bypassing previous patches...

Race condition

A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passengerinstanceregistrydir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but befor...

Dell EMC ECOM XML External Entity Injection Vulnerability

Dell EMC is the new name for the business following the completion of Dell's acquisition of EMC. An XML external entity injection vulnerability exists in Dell EMC ECOM. Allows an attacker to gain unauthorized access to files containing sensitive information or could be used to cause a denial of...

Sensitive File Disclosure (HTTP)

The script attempts to identify files containing sensitive data at the remote web server. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Pivotal Spring Framework Directory Traversal Vulnerability

Pivotal Spring Framework is the U.S. Pivotal Software, Inc. of a set of open source Java, Java EE application framework. A directory traversal vulnerability exists in Pivotal Spring Framework. A remote attacker can use the directory traversal character "..." to access an arbitrary file that...