CVE-2012-4991

HighCVSS 8.5/10Last modified Jun 16, 2026

Description

Multiple directory traversal vulnerabilities in Axway SecureTransport 5.1 SP2 and earlier allow remote authenticated users to (1) read, (2) delete, or (3) create files, or (4) list directories, via a ..%5C (encoded dot dot backslash) in a URI.

Metrics

CVSS 2.0 8.5/10AV:N/AC:L/Au:S/C:C/I:C/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 13, 2012
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2012

CVE-2012-49929.0Multiple buffer overflows in FlashFXP.exe in FlashFXP 4.2 allow remote authenticated users to execute arbitrary code via a long unicode striCVE-2012-49937.5torrent_functions.php in RivetTracker 1.03 and earlier does not properly restrict access, which allows remote attackers to have an unspecifiCVE-2012-49946.5SQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows remote authenticated users to execute arbitrarCVE-2012-49954.3Cross-site scripting (XSS) vulnerability in admin/userrighthandling.php in LimeSurvey before 1.91+ Build 120224 allows remote attackers to iCVE-2012-49967.5Multiple SQL injection vulnerabilities in RivetTracker 1.03 and earlier allow remote attackers to execute arbitrary SQL commands via the hasCVE-2012-49977.5Directory traversal vulnerability in acp/index.php in AneCMS allows remote attackers to include and execute arbitrary local files via a .. (CVE-2012-49984.3Cross-site scripting (XSS) vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script or HTML via the q paCVE-2012-49996.1Mercury MR804 Router 8.0 3.8.1 Build 101220 Rel.53006nB allows remote attackers to cause a denial of service (service hang) via a crafted stCVE-2012-50007.5SQL injection vulnerability in jokes/index.php in the Witze addon 0.9 for deV!L'z Clanportal allows remote attackers to execute arbitrary SQCVE-2012-50017.5Multiple unspecified vulnerabilities in Hitachi JP1/Cm2/Network Node Manager i before 09-50-03 allow remote attackers to cause a denial of sCVE-2012-50026.8Stack-based buffer overflow in SR10 FTP server (SR10.exe) 1.1.0.6 in Ricoh DC Software DL-10 4.5.0.1, when the Log file name option is enablCVE-2012-50036.8nxapplet.jar in No Machine NX Web Companion 3.x and earlier does not properly verify the authenticity of updates, which allows user-assisted
CVE-2012-4991: High severity, CVSS 8.5 | Vulnix