16900 matches found
CVE-2018-20159
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file...
CVE-2018-20159
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file...
CVE-2018-20157
The data import functionality in OpenRefine through 3.1 allows an XML External Entity XXE attack through a crafted zip file, allowing attackers to read arbitrary files...
CVE-2018-20157
The data import functionality in OpenRefine through 3.1 allows an XML External Entity XXE attack through a crafted zip file, allowing attackers to read arbitrary files...
CVE-2018-20157
The data import functionality in OpenRefine through 3.1 allows an XML External Entity XXE attack through a crafted zip file, allowing attackers to read arbitrary files...
UBUNTU-CVE-2018-19039
Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions...
Directory traversal
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15 Update 4, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15 Update 4, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F All versions V15 Update 4, SIMATIC WinCC Runtime...
CVE-2018-20128
An issue was discovered in UsualToolCMS v8.0. cmsadmin\asqlback.php allows remote attackers to delete arbitrary files via a backname directory-traversal pathname followed by a crafted substring...
CVE-2018-20127
zzzphp cms 1.5.8 contains a flaw in the del_file function of /admin/save.php that permits remote deletion of arbitrary files via a mixed-case extension and an extra '.' character (e.g., path=F:/1.phP.). Root cause: improper validation of file extensions and path syntax leads to arbitrary file del...
AIX 7.1 TL 4 : xorg (IJ11544)
https://vulners.com/cve/CVE-2018-14665 https://vulners.com/cve/CVE-2018-14665 X.Org X server could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper validation of command line parameters. An attacker could exploit this vulnerability using the...
CVE-2018-16867
A flaw was found in qemu Media Transfer Protocol MTP before version 3.1.0. A path traversal in the in usbmtpwritedata function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest device is mounted in read-write mode, this allows to read/write arbitrary files which may lea...
CVE-2018-20064
CVE-2018-20064 concerns doorGets 7.0, where a directory-traversal flaw lets remote attackers write arbitrary files. The root cause is a crafted request to dg-user/?controller=theme&action=edit&name=doorgets&file=../../1.txt%00 with content provided in theme_content_nofi, enabling arbitrary file w...
CVE-2018-20064
doorGets 7.0 allows remote attackers to write to arbitrary files via directory traversal, as demonstrated by a dg-user/?controller=theme&action=edit&name=doorgets&file=../../1.txt%00 URI with content in the themecontentnofi parameter...
CVE-2018-15805
Accusoft PrizmDoc HTML5 Document Viewer before 13.5 contains an XML external entity XXE vulnerability, allowing an attacker to read arbitrary files or cause a denial of service resource consumption...
CVE-2018-15805
Accusoft PrizmDoc HTML5 Document Viewer before 13.5 contains an XML external entity XXE vulnerability, allowing an attacker to read arbitrary files or cause a denial of service resource consumption...
i-doit CMDB 1.11.2 - Remote Code Execution
i-doit CMDB 1.11.2 - Remote Code Execution Exploit Title: i-doit CMDB 1.11.2 - Remote Code Execution Date: 2018-12-05 Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.i-doit.org/ Software Link: https://www.i-doit.org/i-doit-open-1-11-2/ Versio...
i-doit CMDB 1.11.2 Remote Code Execution
Exploit Title: i-doit CMDB 1.11.2 - Remote Code Execution Date: 2018-12-05 Exploit Author: Azkan Mustafa AkkuA AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.i-doit.org/ Software Link: https://www.i-doit.org/i-doit-open-1-11-2/ Version: v1.11.2 Category: Webapps Tested on: XAM...
ASUSTOR ADM File Explorer Path Traversal Vulnerability
ASUSTOR ADM is a set of operating systems from ASUSTOR dedicated to ASUSTOR NAS storage devices.File Explorer is one of the file browsers. A directory traversal vulnerability exists in File Explorer in ASUSTOR ADM version 3.1.1. An attacker can exploit this vulnerability by modifying the 'file1'...
Google Chrome Security Bypass Vulnerability (CNVD-2019-01773)
Google Chrome is the United States Google Google company developed a Web browser. Devtools is one of the development and debugging tools. A security vulnerability exists in DevTools in versions of Google Chrome prior to 68.0.3440.75, which stems from an implementation of the Page.downloadBehavior...