Directory traversal

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714...

CVE-2019-10720

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714...

PT-2019-12010

Name of the Vulnerable Software and Affected Versions BlogEngine.NET versions 3.3.7.0 and earlier Description The issue allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. This problem exists due to an incomplete fix for a previous issue. Recommendations...

CVE-2019-10720: Improper Limitation of a Pathname to a Restricted Directory

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714...

BlogEngine.NET 3.3.6 / 3.3.7 Theme Cookie Directory Traversal / Remote Code Execution

Exploit Title: Directory Traversal + RCE on BlogEngine.NET Date: 17 Jun 2019 Exploit Author: Aaron Bishop Vendor Homepage: https://blogengine.io/ Version: v3.3.7 Tested on: 3.3.7, 3.3.6 CVE : 2019-10720 1. Description ============== BlogEngine.NET is vulnerable to a Directory Traversal through th...

BlogEngine.NET 3.3.7 Directory Traversal / Remote Code Execution

BlogEngine.NET, versions 3.3.7 and earlier, is vulnerable to two separate Directory Traversal issues that can lead to Remote Code Execution. CVE-2019-10719 exploits a directory traversal in /api/upload, allowing users to write files to any location within the web root. This bypasses the protectio...

PT-2015-6583

Name of the Vulnerable Software and Affected Versions Anima Gallery version 2.6 Description The issue concerns directory traversal vulnerabilities in the func.php file of Anima Gallery. Remote attackers can exploit this by including and executing arbitrary local files. This can be achieved by usi...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in JBlog 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to a index.php, or the 2 search parameter or 3 theme cookie to b recherche.php...

CVE-2007-3973: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in JBlog 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to a index.php, or the 2 search parameter or 3 theme cookie to b recherche.php...