PT-2015-6396

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 12.0.0 Enterprise Manager versions 3.0.0 through 3.1.1 Description A directory traversal issue exists in the configuration utility, allowing remote authenticated users to access arbitrary files in the web root...

F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K17253)

Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the web root via unspecified vectors. CVE-2015-4040 Impact An authenticated user is able to traverse...

E-Detective Lawful Interception System LFD / Code Execution

Advisory: E-Detective Lawful Interception System multiple security vulnerabilities Date: 14/06/2015 CVE: unassigned Authors: Mustafa Al-Bassam https://musalbas.com slipstream/RoL https://twitter.com/TheWack0lian Software: Decision Group E-Detective Lawful Interception System Vendor URL:...

CVE-2014-8605

The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/...

CVE-2014-8605

The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/...

Directory traversal

Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL, XL1000C100U 104 I/O UUKL, XL1000C500U 300 I/O UUKL, and XL1000C1000U 600 I/O UUKL controllers before 2.04.01 allows...

VulnCheck KEV: CVE-2014-4019

ZTE ZXV10 W300 router with firmware W300V1.0.0aZRDLK stores sensitive information under the web root with insufficient access control, which allows remote attackers to read backup files via a direct request for rom-0...

Server: Bypass of file blacklist

A blacklist bypass vulnerability including UTF-8 encoding in file paths in the mentioned ownCloud versions, allows authenticated remote attackers to bypass the file blacklist and upload files such as the .htaccess files. An attacker could leverage this bypass by uploading a .htaccess and execute...

Server: Bypass of file blacklist on Microsoft Windows Platform

A blacklist bypass vulnerability including UTF-8 encoding in file paths in the mentioned ownCloud Server versions, when running on a Microsoft Windows Platform, allows authenticated remote attackers to bypass the file blacklist and upload files such as the .htaccess files. An attacker could...

Honeywell XL Web Controller Directory Traversal Vulnerability

Honeywell XL Web Controller is a web-based SCADA system. A security vulnerability exists in Honeywell XL Web Controller, which can be exploited by an attacker to access the Web Root directory of an affected system via a directory traversal vulnerability within the FTP server...

CVE-2014-6316

core/stringapi.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open redirect and phishing attacks via a crafted URL in the return parameter to loginpage.php...

Directory traversal

Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. dot dot sequences in its name, then accessing t...

CVE-2014-8329

Schrack Technik microControl with firmware before 1.7.0 937 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain access data for the ftp and telnet services via a direct request for ZTPUsrDtls.txt...

Improper access control

Schrack Technik microControl with firmware before 1.7.0 937 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain access data for the ftp and telnet services via a direct request for ZTPUsrDtls.txt...

CVE-2014-8329

Schrack Technik microControl with firmware before 1.7.0 937 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain access data for the ftp and telnet services via a direct request for ZTPUsrDtls.txt...

ManageEngine Desktop Central StatusUpdate Arbitrary File Upload

This module exploits an arbitrary file upload vulnerability in ManageEngine DesktopCentral v7 to v9 build 90054 including the MSP versions. A malicious user can upload a JSP file into the web root without authentication, leading to arbitrary code execution as SYSTEM. Some early builds of version ...

ManageEngine Password Manager MetadataServlet.dat SQL Injection Exploit

This Metasploit module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet, which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and Password Manager Pro v6 build 6500 to v7 build 7002 including the MSP versions. The SQL injection can be used to...

Directory traversal

Directory traversal vulnerability in Cisco Unified Contact Center Enterprise allows remote authenticated users to read arbitrary web-root files via a crafted URL, aka Bug ID CSCun25262...

Sitebuilder 1.4 'sitebuilder.cgi' Directory Traversal File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8521/info Sitebuilder is said to be prone to a directory traversal vulnerability, potentially allowing users to disclose the contents of system files. The problem occurs due to the application failing to parse user-suppli...

datawizard webxq 2.1.204 - Directory Traversal vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2660/info DataWizard WebXQ server could be led to traverse directories and possibly reveal files outside of the web root. By including '/../' sequences along with a known file or directory in requested URLs, a remote user...