rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-5490 
Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-15T02:00:00.000Z
CVE-2017-5491 
wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-15T02:00:00.000Z
CVE-2017-5492 
Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-15T02:00:00.000Z
CVE-2017-5493 
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-15T02:00:00.000Z
CVE-2017-5494 
Multiple cross-site scripting (XSS) vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a (1) comment frame or (2) avatar frame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-15T22:00:00.000Z
CVE-2017-5495 
All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their telnet CLI enabled, anyone who can connect to the TCP ports can trigger this vulnerability, prior to authentication. Most distributions restrict the Quagga telnet interface to local access only by default. The Quagga telnet interface 'vty' input buffer grows automatically, without bound, so long as a newline is not entered. This allows an attacker to cause the Quagga daemon to allocate unbounded memory by sending very long strings without a newline. Eventually the daemon is terminated by the system, or the system itself runs out of memory. This is fixed in Quagga 1.1.1 and Free Range Routing (FRR) Protocol Suite 2017-01-10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-24T07:40:00.000Z
CVE-2017-5496 
Sawmill Enterprise 8.7.9 allows remote attackers to gain login access by leveraging knowledge of a password hash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T15:00:00.000Z
CVE-2017-5498 
libjasper/include/jasper/jas_math.h in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T15:00:00.000Z
CVE-2017-5499 
Integer overflow in libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T15:00:00.000Z
CVE-2017-5500 
libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T15:00:00.000Z
CVE-2017-5501 
Integer overflow in libjasper/jpc/jpc_tsfb.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T15:00:00.000Z
CVE-2017-5502 
libjasper/jp2/jp2_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T15:00:00.000Z
CVE-2017-5503 
The dec_clnpass function in libjasper/jpc/jpc_t1dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T15:00:00.000Z
CVE-2017-5504 
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T15:00:00.000Z
CVE-2017-5505 
The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-16T15:00:00.000Z
CVE-2017-5506 
Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2017-5507 
Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via vectors involving a pixel cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2017-5508 
Heap-based buffer overflow in the PushQuantumPixel function in ImageMagick before 6.9.7-3 and 7.x before 7.0.4-3 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2017-5509 
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2017-5510 
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2017-5511 
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2017-5515 
Cross-site scripting (XSS) vulnerability in the user prompt function in GeniXCMS through 0.0.8 allows remote authenticated users to inject arbitrary web script or HTML via tag names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-17T09:22:00.000Z
CVE-2017-5516 
Multiple cross-site scripting (XSS) vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML via crafted parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-17T09:22:00.000Z
CVE-2017-5517 
SQL injection vulnerability in author.control.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the type parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-17T09:22:00.000Z
CVE-2017-5518 
The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as demonstrated by a URL with an intranet IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-17T09:22:00.000Z
CVE-2017-5519 
SQL injection vulnerability in Posts.class.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-17T09:22:00.000Z
CVE-2017-5520 
The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to rename and execute files with the `.php6`, `.php7` and `.phtml` extensions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-17T09:22:00.000Z
CVE-2017-5521 
An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-17T09:22:00.000Z
CVE-2017-5522 
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T16:00:00.000Z
CVE-2017-5524 
Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T16:00:00.000Z
CVE-2017-5525 
Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T15:00:00.000Z
CVE-2017-5526 
Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T15:00:00.000Z
CVE-2017-5527 TIBCO Spotfire injection vulnerabilities
TIBCO Spotfire Server 7.0.X before 7.0.2, 7.5.x before 7.5.1, 7.6.x before 7.6.1, 7.7.x before 7.7.1, and 7.8.x before 7.8.1 and Spotfire Analytics Platform for AWS Marketplace 7.8.0 and earlier contain multiple vulnerabilities which may allow authorized users to perform SQL injection attacks.
Problem types: description: SQL injection attack
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
Published: 2017-05-09T20:00:00.000Z
CVE-2017-5528 TIBCO JasperReports Server cross-site vulnerabilities
Multiple JasperReports Server components contain vulnerabilities which may allow authorized users to perform cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks.  The impact of this vulnerability includes the theoretical disclosure of sensitive information.  Affects TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.2.0 and below), and TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.2.0 and below).
Problem types: description: Cross site scripting
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft for AWS with Multi-Tenancy
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft Reporting and Analytics for AWS
Published: 2017-06-29T14:00:00.000Z
CVE-2017-5529 TIBCO JasperReports Library Information Disclosure
JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below), TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO JasperReports Professional (versions 6.2.1 and below, and 6.3.0), TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.3.0 and below), TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.3.0 and below), and TIBCO Jaspersoft Studio for ActiveMatrix BPM (versions 6.2.0 and below).
Problem types: description: Information disclosure
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Library Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Library for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Professional
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft for AWS with Multi-Tenancy
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft Reporting and Analytics for AWS
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft Studio for ActiveMatrix BPM
Published: 2017-06-29T14:00:00.000Z
CVE-2017-5530 SAML protocol handling errors in tibbr
The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0, tibbr Enterprise 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0.
Problem types: description: The impact of this vulnerability includes, for already authorized users, the theoretical escalation of privileges to those of any other user.
Affected products: vendor: TIBCO Software Inc.
product: tibbr Community
vendor: TIBCO Software Inc.
product: tibbr Enterprise
Published: 2017-12-13T02:00:00.000Z
CVE-2017-5531 
Deployments of TIBCO Managed File Transfer Command Center versions 8.0.0 and 8.0.1 and TIBCO Managed File Transfer Internet Server versions 8.0.0 and 8.0.1 that enable the Administrator Service may be affected by a vulnerability which may allow any authenticated user to gain administrative control of Managed File Transfer web applications.
Problem types: description: privilege escalation
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Command Center
vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Internet Server
Published: 2017-10-17T20:00:00.000Z
CVE-2017-5532 TIBCO JasperReports persistent cross site scripting
A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow a subset of authorized users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO JasperReports Server 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0 and below, TIBCO JasperReports Library 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1, TIBCO JasperReports Library for ActiveMatrix BPM 6.4.1 and below, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0 and below, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0 and below, TIBCO Jaspersoft Studio 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, and TIBCO Jaspersoft Studio for ActiveMatrix BPM 6.4.0 and below.
Problem types: description: The impact of this vulnerability includes the possibility that a malicious user can gain access to a more privileged account.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Library
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Library for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft for AWS with Multi-Tenancy
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft Reporting and Analytics for AWS
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft Studio
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft Studio for ActiveMatrix BPM
Published: 2017-11-15T21:00:00.000Z
CVE-2017-5533 TIBCO JasperReports Server credentials disclosure
A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which fails to prevent remote access to all the contents of the web application, including key configuration files. Affected releases are TIBCO JasperReports Server 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0.
Problem types: description: The impact includes the possible access to web application configuration files that contain the credentials used by the server. Those credentials could then be used to affect external systems accessed by the JasperReports Server.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft for AWS with Multi-Tenancy
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft Reporting and Analytics for AWS
Published: 2017-11-15T21:00:00.000Z
CVE-2017-5534 Improper sandboxing of a third-party component in tibbr
The tibbr user profiles components of tibbr Community, and tibbr Enterprise expose a weakness in an improperly sandboxed third-party component. Affected releases are TIBCO Software Inc. tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0, tibbr Enterprise 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0.
Problem types: description: The impact of this vulnerability includes the ability to execute arbitrary code with the privileges of the user that invoked the tibbr server.
Affected products: vendor: TIBCO Software Inc.
product: tibbr Community
vendor: TIBCO Software Inc.
product: tibbr Enterprise
Published: 2017-12-13T02:00:00.000Z
CVE-2017-5535 TIBCO DataSynapse GridServer improper use of encryption
The GridServer Broker, GridServer Driver, and GridServer Engine components of TIBCO Software Inc. TIBCO DataSynapse GridServer Manager contain vulnerabilities related to both the improper use of encryption mechanisms and the use of weak ciphers. A malicious actor could theoretically compromise the traffic between any of the components. Affected releases include TIBCO Software Inc.'s TIBCO DataSynapse GridServer Manager: versions up to and including 5.1.3; 6.0.0; 6.0.1; 6.0.2; 6.1.0; 6.1.1; and 6.2.0.
Problem types: description: A user with access to network traffic between the affected components could potentially examine that traffic, including passwords used to encrypt further communications.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO DataSynapse GridServer Manager
Published: 2018-05-01T18:00:00.000Z
CVE-2017-5536 TIBCO DataSynapse GridServer manager component vulnerable to cross-site scripting attacks
The GridServer Broker, and GridServer Director components of TIBCO Software Inc. TIBCO DataSynapse GridServer Manager contain vulnerabilities which may allow an authenticated user to perform cross-site scripting (XSS). In addition, an authenticated user could be a victim of a cross-site request forgery (CSRF) attack. Affected releases include TIBCO Software Inc.'s TIBCO DataSynapse GridServer Manager: versions up to and including 5.1.3; 6.0.0; 6.0.1; 6.0.2; 6.1.0; 6.1.1; and 6.2.0.
Problem types: description: The impact of this vulnerability includes the possibility that a malicious actor could gain access to a more privileged account on the affected components or the information managed by those components.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO DataSynapse GridServer Manager
Published: 2018-05-01T18:00:00.000Z
CVE-2017-5537 
The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T15:00:00.000Z
CVE-2017-5538 
The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) and N(7.0) software and Exynos AP chipsets allows attackers to have unspecified impact via unknown vectors, which trigger an out-of-bounds read, aka SVE-2016-6362.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T16:00:00.000Z
CVE-2017-5539 
The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\/ to bypass the filter rule. Then, this attacker can exploit this vulnerability to delete or read any files on the server. It can also be used to determine whether a file exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T06:49:00.000Z
CVE-2017-5541 
Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to rename arbitrary files via a .. (dot dot) in the existing-folder and new-folder parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-20T08:39:00.000Z