CVE-2020-9297

Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary...

CVE-2020-9297

CVE-2020-9297 affects Netflix Titus prior to v0.1.1-rc.274. The issue arises when building custom constraint violation messages with ConstraintValidatorContext.buildConstraintViolationWithTemplate(); an attacker could inject arbitrary data into the error message template, enabling execution of ar...

CVE-2020-9296

CVE-2020-9296 affects Netflix Titus and Netflix Conductor through Java Bean Validation (JSR 380) custom constraint validators. The issue arises when building constraint violation messages via ConstraintValidatorContext.buildConstraintViolationWithTemplate(): attacker-controlled data in the templa...

Remote code execution

A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution RCE vulnerability. Apache Syncope uses Java Bean Validation JSR 380 custom constraint validators. When...

Unspecified Vulnerability in Multiple HPE Products

HPE SimpliVity 380 Gen 9 and others are a server from Hewlett Packard Enterprise HPE in the United States. A security vulnerability exists in several HPE products. An attacker could exploit the vulnerability to create and delete arbitrary files...

Unspecified Vulnerability in Multiple HPE Products (CNVD-2020-04655)

HPE SimpliVity 380 Gen 9 and others are a server from Hewlett Packard Enterprise HPE in the United States. A security vulnerability exists in several HPE products. The vulnerability can be exploited by an attacker to execute a manifest file in an arbitrary location...

CVE-2018-20926

cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface SEC-380...

Design/Logic Flaw

cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface SEC-380...

CVE-2018-20926

CVE-2018-20926 affects cPanel before 70.0.23 and allows local privilege escalation via the WHM Locale XML Upload interface (SEC-380). Red Hat notes the issue in cPanel prior to 70.0.23; CNVD/CVELIST entries confirm the same. Impact is local, with privileges elevated if exploited. Remediation is u...

VelotiSmart WiFi B-380 Camera - Directory Traversal

VelotiSmart WiFi B-380 Camera - Directory Traversal Title: Vulnerability in VelotiSmart Wifi - Directory Traversal Date: 12-07-2018 Scope: Directory Traversal Platforms: Unix Author: Miguel Mendez Z Vendor: VelotiSmart Version: B380 CVE: CVE-2018–14064 Vulnerability description...

VelotiSmart WiFi B-380 Camera - Directory Traversal Vulnerability

Exploit for hardware platform in category web applications Title: Vulnerability in VelotiSmart Wifi - Directory Traversal Date: 12-07-2018 Scope: Directory Traversal Platforms: Unix Author: Miguel Mendez Z Vendor: VelotiSmart Version: B380 CVE: CVE-2018–14064 Vulnerability description...

CVE-2018-14064

The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80...

Directory traversal

The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80...

CVE-2018-14064

The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80...

CVE-2018-14064

VelotiSmart WiFi B-380 cameras are affected by CVE-2018-14064 due to a Directory Traversal (LFI) in the uc-http service 1.0.0, exploitable via /../../etc/passwd on TCP port 80. The Nuclei template and related advisories confirm unauthenticated access can read arbitrary device files and sensitive ...

CVE-2018-14064

The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80...

CVE-2017-2606

Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible SECURITY-380. This only affects anonymous users other users legitimately have access that were able to get a list of items via an...

CVE-2017-2606

CVE-2017-2606 affects Jenkins prior to 2.44 and prior to 2.32.2, exposing item names via the internal API to anonymous users via UnprotectedRootAction. Root cause: information exposure from the internal API due to insufficient access controls. Impact: information disclosure of item names. Remedia...

CVE-2017-8838

XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. The affected script is cgi-bin/HASync/hasync.cgi...

380 Pics - External URLs, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application 380 Pics published at the 'play' market has multiple vulnerabilities...