38 matches found
CVE-2023-6849
CVE-2023-6849 affects kalcaddle kodbox up to 1.48, with the vulnerable code in the function cover of plugins/fileThumb/app.php. The issue stems from manipulating the path argument which enables server-side request forgery (SSRF) and can be exploited remotely; exploitation status is not specified ...
Schneider Electric Modicon Exposure of Sensitive Information to an Unauthorized Actor (CVE-2019-6849)
A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when using specific Modbus services provided by the REST API of the controller/communication module. This plugin only works...
CVE-2020-6849
The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketofat CSRF with resultant XSS...
CVE-2020-6849
CVE-2020-6849 concerns the WordPress plugin marketo-forms-and-tracking (
CVE-2019-6849
CVE-2019-6849 affects Schneider Electric Modicon M580 controllers and BMENOC 0311/0321 modules, where certain Modbus REST API services may disclose sensitive information. The root cause is an information-exposure vulnerability (CWE-200) in the Modbus services exposed by the controller/communicati...
Design/Logic Flaw
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
CVE-2018-17676
Foxit Reader 9.2.0.9297 is vulnerable to a remote code execution flaw in the removeField handling of an app object. The issue arises from not validating the existence of an object before performing operations, effectively enabling an attacker to execute code in the context of the current process....
CVE-2018-17676
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
CVE-2018-6849
creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/browserlanipleak.rb 2025-02-06 03:13:43+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:10:08+00:00| seen|...
CVE-2018-6849
CVE-2018-6849 affects the WebRTC component in DuckDuckGo 4.2.0, enabling leakage of a client’s private IP address in a STUN request after visiting a site that tries to enumerate network information (e.g., ip.voidsec.com). The vulnerability description and multiple connected sources confirm the is...
CVE-2014-6849
CVE-2014-6849 entry is rejected/not used and does not represent an active vulnerability.
CVE-2017-6849
The PoDoFo::PdfColorGray::PdfColorGray function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted file...
CVE-2017-6849
CVE-2017-6849 affects PoDoFo 0.9.4, where PoDoFo::PdfColorGray::~PdfColorGray can cause a denial of service via a crafted PDF file due to a NULL pointer dereference. The vulnerability is confirmed in multiple OSV and security-advisory records tied to PoDoFo, including SUSE advisories that list CV...
CVE-2017-6849
The PoDoFo::PdfColorGray::PdfColorGray function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted file...
CVE-2015-6849
CVE-2015-6849 affects EMC NetWorker prior to 8.0.4.5, 8.1.x prior to 8.1.3.6, 8.2.x prior to 8.2.2.2, and 9.0 before build 407. The vulnerability is a denial of service caused by improper handling of malformed RPC authentication messages, allowing an unauthenticated, remote attacker to crash the ...
CVE-2008-6849
CVE-2008-6849 describes an unrestricted file upload vulnerability in the PHP application phpGreetCards 3.7. The flaw is triggered in index.php, allowing remote attackers to upload a file with an executable extension and then access it via a link found in userfiles/number_shell.php, enabling arbit...