Cross-site Scripting (XSS)

resin is vulnerable to cross-site scripting XSS attacks. The vulnerability exists through the viewfile documentation command where the value of the file parameter can be used for XSS attacks...

CVE-2017-7433

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

Path traversal

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

CVE-2017-7433

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

PT-2017-17735

Name of the Vulnerable Software and Affected Versions Micro Focus Vibe versions 4.0.2 and earlier Description The issue allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the "viewFile" endpoint. If Guest access is...

CVE-2017-7433: Improper Limitation of a Pathname to a Restricted Directory

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

Turbomail turbomail. web. ViewFile parameters filename arbitrary file read vulnerability

No description provided by source...

CVE-2016-4004

Directory traversal vulnerability in Dell OpenManage Server Administrator OMSA 8.2 allows remote authenticated administrators to read arbitrary files via a ..\ dot dot backslash in the file parameter to ViewFile...

CVE-2016-4004: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Dell OpenManage Server Administrator OMSA 8.2 allows remote authenticated administrators to read arbitrary files via a ..\ dot dot backslash in the file parameter to ViewFile...

PT-2016-5803

Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator OMSA version 8.2 Description A directory traversal issue allows remote authenticated administrators to read arbitrary files by using a .. dot dot backslash in the file parameter to the ViewFile endpoint...

Caucho Resin 3.0.17/3.0.18 Viewfile Information Disclosure Vulnerability

No description provided by source...

XSS vulnerability in Office Connector plugin

From: OFFCONN-81: Using "office excel"-macro as part of viewfile, which is part of office connector plugin seems to open up the possibility to get injected with XSS-code. Steps to reproduce: 1. Create an excel-file with following content in one cell: code '"alert'XSS' code 2. Attach this file to ...

Viewfile macros do not respect page restrictions

Add a page Set viewing restrictions to user1 only Add an attachment - 'Sample.doc' Log in as user2 - confirm that you cannot see the restricted page Add a page, and use the viewfile macro Enter the location of the attachment on the restricted page The contents of the attachment can now be viewed ...

Viewfile macros do not respect page restrictions

Add a page Set viewing restrictions to user1 only Add an attachment - 'Sample.doc' Log in as user2 - confirm that you cannot see the restricted page Add a page, and use the viewfile macro Enter the location of the attachment on the restricted page The contents of the attachment can now be viewed ...

CVE-2008-2462: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter...

Resin viewfile Servlet file Parameter XSS

The remote host is running Resin, an application server. The 'viewfile' Servlet included with the version of Resin installed on the remote host fails to sanitize user input to the 'file' parameter before including it in dynamic HTML output. An attacker may be able to leverage this issue to inject...

TWiki Viewfile目录遍历漏洞

TWiki是一款流行的基于WEB的百科全书程序 TWiki不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限查看系统文件内容。 问题是由于'TWikiDocGraphics'脚本对用户提交给'filename'参数缺少过滤，提交包含多个"../"字符作为参数数据，可绕过WEB ROOT限制以WEB进程权限查看系统文件内容。 0 TWiki TWiki 04x00x03 TWiki TWiki 04x00x04 TWiki TWiki 04x00x02 TWiki TWiki 04x00x01 TWiki TWiki 04x00x00 可参考如下补丁程序： a...

CVE-2006-4294: Undefined Security Weakness

Directory traversal vulnerability in viewfile in TWiki 4.0.0 through 4.0.4 allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

Directory traversal

Directory traversal vulnerability in the viewfile servlet in the documentation package resin-doc for Caucho Resin 3.0.17 and 3.0.18 allows remote attackers to read arbitrary files under other web roots via the contextpath parameter. NOTE: this issue can produce resultant path disclosure when the...

CVE-2006-2438

Directory traversal vulnerability in the viewfile servlet in the documentation package resin-doc for Caucho Resin 3.0.17 and 3.0.18 allows remote attackers to read arbitrary files under other web roots via the contextpath parameter. NOTE: this issue can produce resultant path disclosure when the...