TerraMaster TOS 4.2.x session forgery, arbitrary file reading, remote command execution, and other vulnerabilities

TerraMaster is a globally recognized professional storage brand that focuses on providing professional private cloud storage devices for users around the world. The vulnerabilities in TerraMaster TOS 4.2.x session forgery, arbitrary file reading, and remote command execution can be exploited to...

RUSTSEC-2021-0126 RustEmbed generated `get` method allows for directory traversal when reading files from disk

When running in debug mode and the debug-embed off by default feature is not enabled, the generated get method does not check that the input path is a child of the folder given. This allows attackers to read arbitrary files in the file system if they have control over the filename given. The...

PT-2021-24286

Name of the Vulnerable Software and Affected Versions: rust-embed crate versions prior to 6.3.0 Description: The issue allows attackers to read arbitrary files in the file system if they have control over the filename given, specifically when running in debug mode and the debug-embed feature is n...

Arbitrary File Read Vulnerability in Cyber-Sign's NetSign Digital Signature System

Ltd. is the earliest professional vendor engaged in the research, development and application of PKI technology in China. There is an arbitrary file reading vulnerability in the NetSign digital signature system, which can be exploited by an attacker to read server files...

Arbitrary file reading vulnerability in Aim

Impact A path traversal attack aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash ../” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and...

CVE-2021-40745 Adobe Campaign Path Traversal Leads to Information Exposure

Adobe Campaign version 21.2.1 and earlier is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an exposed XML file, an unauthenticated attacker can enumerate other files on the server...

Registration in OO Arbitrary File Read

The vulnerability of the automated information system “Registration in OO” is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to remotely read arbitrary files by sending a specially crafted POST request...

CVE-2021-36172

An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of service or read arbitrary files from the underlying file...

Kingdee Cloud Star Management Center has an arbitrary file reading vulnerability

Kingdee Cloud Star Management Center is a new generation of strategic enterprise management software developed by Kingdee Software China Co. based on cloud computing, big data, social, artificial intelligence, Internet of Things and other cutting-edge technologies. There is an arbitrary file...

PT-2021-22585

Name of the Vulnerable Software and Affected Versions: BIQS IT Biqs-drive versions 1.83 and below Description: A local file inclusion LFI issue exists when sending a specific payload as the file parameter to the "download/index.php" endpoint. This allows an attacker to read arbitrary files from t...

PortlandLabs Concrete CMS Path Traversal Vulnerability (CNVD-2021-76081)

PortlandLabs Concrete Cms is a team-oriented open source content management system for the United States PortlandLabs . A path traversal vulnerability exists in PortlandLabs Concrete CMS, which stems from the product's failure to securely handle user input data. The vulnerability can be exploited...

CVE-2021-40103

An issue was discovered in Concrete CMS through 8.5.5. Path Traversal can lead to Arbitrary File Reading and SSRF...

Path traversal

An issue was discovered in Concrete CMS through 8.5.5. Path Traversal can lead to Arbitrary File Reading and SSRF...

CVE-2021-40103

An issue was discovered in Concrete CMS through 8.5.5. Path Traversal can lead to Arbitrary File Reading and SSRF...

CVE-2021-40103

Concrete CMS (affected: up to version 8.5.5) is vulnerable to a path traversal issue that can lead to arbitrary file reading and SSRF. The CVE entry CVE-2021-40103 documents this vulnerability with impact stated as partial confidentiality exposure and potential SSRF, but explicit exploit details ...

CVE-2021-40103

An issue was discovered in Concrete CMS through 8.5.5. Path Traversal can lead to Arbitrary File Reading and SSRF...

CVE-2021-40103: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Concrete CMS through 8.5.5. Path Traversal can lead to Arbitrary File Reading and SSRF...

PT-2021-22812

Name of the Vulnerable Software and Affected Versions Concrete CMS versions through 8.5.5 Description An issue in Concrete CMS allows Path Traversal, which can lead to Arbitrary File Reading and Server-Side Request Forgery SSRF. Recommendations For versions through 8.5.5, update to a version late...

CVE-2019-9060

CMS Made Simple 2.2.8 is affected by CVE-2019-9060 via the CGExtensions module (action.setdefaulttemplate.php) using m1_filename for unauthenticated path traversal and through action.showmessage.php with m1_prefname cg_errormsg and m1_resettodefault=1 to read arbitrary files. Impact: partial conf...

Arbitrary File Read Vulnerability in ECShop of Shanghai Shangpai Network Technology Co.

ECShop is a B2C independent online store system developed based on PHP language and MYSQL database framework, suitable for enterprises and individuals to quickly build a personalized online store. Ltd. ECShop has an arbitrary file read vulnerability, which can be exploited by attackers to obtain...