CVE-2017-10907

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in OneThird CMS Show Off v1.85 and earlier. Show Off v1.85 en and earlier allows an attacker to read arbitrary files via unspecified vectors.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Dec 22, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-109087.5H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.CVE-2017-109097.8Untrusted search path vulnerability in Music Center for PC version 1.0.01 and earlier allows an attacker to gain privileges via a Trojan hor CVE-2017-109106.5MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tickets may lead to an attacker causing a denial-of-service condition.CVE-2017-109116.5The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitiv CVE-2017-1091210.0Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217.CVE-2017-109139.8The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of concurrent unmap calls, which allows bac CVE-2017-109148.1The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial of CVE-2017-109159.0The shadow-paging feature in Xen through 4.8.x mismanages page references and consequently introduces a race condition, which allows guest O CVE-2017-109167.5The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection CVE-2017-109179.1Xen through 4.8.x does not validate the port numbers of polled event channel ports, which allows guest OS users to cause a denial of service CVE-2017-1091810.0Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to obtain privileged host CVE-2017-109196.5Xen through 4.8.x mishandles virtual interrupt injection, which allows guest OS users to cause a denial of service (hypervisor crash), aka X