CVE-2020-12737

An issue was discovered in Maxum Rumpus before 8.2.12 on macOS. Authenticated users can perform a path traversal using double escaped characters, enabling read access to arbitrary files on the server...

Tecnick.com TCExam Path Traversal Vulnerability

Tecnick.com TCExam is a Web-based open source e-exam system from Tecnick.com, UK. The system is mainly used for online exams and more. A path traversal vulnerability exists in Tecnick.com TCExam version 14.2.2, which can be exploited by a remote attacker to read the contents of an arbitrary file ...

CVE-2020-4430

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535...

Cross site request forgery (csrf)

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535...

CVE-2020-4430

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535...

Path traversal

Relative Path Traversal in TCExam 14.2.2 allows a remote, authenticated attacker to read the contents of arbitrary files on disk...

CVE-2019-18870

A path traversal via the iniFile parameter in excel.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to download arbitrary files from the host machine...

CVE-2019-18871

A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upload arbitrary files, leading to arbitrary remote code execution...

Path traversal

A path traversal via the iniFile parameter in excel.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to download arbitrary files from the host machine...

Path traversal

A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upload arbitrary files, leading to arbitrary remote code execution...

CVE-2019-18871

The vulnerability CVE-2019-18871 affects Blaauw Remote Kiln Control (v3.00r4) and is a path-traversal flaw in debug.php accessed via default.php. An authenticated attacker can upload arbitrary files, enabling arbitrary remote code execution. Multiple connected sources (Red Hat, CNVD, NVD, CVE lis...

CVE-2020-3309

A vulnerability in Cisco Firepower Device Manager FDM On-Box software could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is due to improper input validation. An attacker could exploit this...

Avira Operations Avira Software Updater Privilege Vulnerability

Avira Operations Avira Software Updater is a software upgrade management tool for Avira products from Avira Operations. A power-up vulnerability exists in Avira Operations Avira Software Updater prior to version 2.0.6.27476, which stems from the program failing to properly handle hard links to...

CVE-2020-12463

An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links. This allows local users to obtain take control of arbitrary files...

Privilege escalation

An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links. This allows local users to obtain take control of arbitrary files...

CVE-2020-12475

TP-Link Omada Controller Software 3.2.6 allows Directory Traversal for reading arbitrary files via com.tplink.eap.web.portal.PortalController.getAdvertiseFile in /opt/tplink/EAPController/lib/eap-web-3.2.6.jar...

CVE-2020-4209

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to create arbitrary files on the system. IBM X-Force ID: 175019...

CVE-2020-4209

CVE-2020-4209 affects IBM Spectrum Protect Plus 10.1.0–10.1.5. The vulnerability is a path traversal that allows a remote attacker to traverse directories and could result in creation of arbitrary files on the system via specially crafted URL requests containing dot-dot sequences (/../). Several ...

EulerOS Virtualization for ARM 64 3.0.2.0 : keepalived (EulerOS-SA-2020-1561)

According to the version of the keepalived package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintDa...

Authorization

Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server...