CVE-2021-45027

Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function, allowing an unauthenticated attacker to read arbitrary files on Windows servers (e.g., win.ini) through unsanitized input in the fileName parameter. Affected lineage from CV...

CVE-2021-47755

Oliver Library Server v5 is affected by an unauthenticated arbitrary file download via the FileServlet endpoint. The root cause is unsanitized input in the fileName parameter, enabling attackers to download arbitrary files from the server filesystem. This impact is described across multiple sourc...