75 matches found
CVE-2022-36558
Seiko SkyBridge MB-A100/A110 v4.2.0 and below implements a hard-coded passcode for the root account. Attackers are able to access the passcord via the file /etc/ciel.cfg...
PT-2022-14083
Name of the Vulnerable Software and Affected Versions WPMK Ajax Finder WordPress plugin versions up to and including 1.0.1 Description The issue is related to Cross-Site Request Forgery, which occurs due to a missing nonce check in the createplugin atf admin setting page function found in the...
GHSA-GP95-PPV5-3JC5 sharp vulnerable to Command Injection in post-installation over build environment
There's a possible vulnerability in logic that is run only at npm install time when installing versions of sharp prior to the latest v0.30.5. This is not part of any runtime code, does not affect Windows users at all, and is unlikely to affect anyone that already cares about the security of their...
PYSEC-2021-346
An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software...
PYSEC-2021-348
Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'simiki/blob/master/simiki/config.py'...
UBUNTU-CVE-2020-35176
In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname omitting the initial /etc, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600...
openSUSE Security Update : python-rtslib-fb (openSUSE-2020-1156)
This update for python-rtslib-fb fixes the following issues : - Update to version v2.1.73 bsc1173257 CVE-2020-14019 : - version 2.1.73 - savetofile: fix fd open mode - saveconfig: copy temp configfile with permissions - saveconfig: open the temp configfile with modes set - Fix 'is not' with a...
CVE-2016-2357
Milesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc/config directory...
CVE-2018-18656
The PureVPN client before 6.1.0 for Windows stores Login Credentials username and password in cleartext. The location of such files is %PROGRAMDATA%\purevpn\config\login.conf. Additionally, all local users can read this file...
EncapsCMS <= 0.3.6 (config[path]) Remote File Include Vulnerability
No description provided by source. + EncapsCMS = 0.3.6 configpath Remote File Include Vulnerability + Discovered by cr4wl3r cr4wl3r!linuxmail.org + Download : http://scripts.ringsworld.com/content-management/encapscms-0.3.6/ + Vuln Code : commonfoot.php include$config'path'.idxfoot.html;...
PHPIDS 0.4 - Remote File Inclusion
PHPIDS 0.4 - Remote File Inclusion PHPIDS 0.4 - Remote File Inclusion Vulnerability @package PHPIDS @Version 0.4 @license http://www.gnu.org/licenses/lgpl.html LGP @link http://php-ids.org/ Type : Remote File Inclusion Vulnerability Author: eidelweiss Date : 2010-02-08 Location: Indonesia...
EncapsCMS 0.3.6 Remote File Inclusion
EncapsCMS + Download : http://scripts.ringsworld.com/content-management/encapscms-0.3.6/ + Vuln Code : commonfoot.php include$config'path'."idxfoot.html"; if$config"debug"0 echo ''; echo '$POST:';vardump$POST; + PoC : EncapsCMSpath/commonfoot.php?configpath=Shell...
EncapsCMS <= 0.3.6 (config[path]) Remote File Include Vulnerability
Exploit for unknown platform in category web applications =================================================================== EncapsCMS 0 echo ''; echo '$POST:';vardump$POST; + PoC : EncapsCMSpath/commonfoot.php?configpath=Shell 0day.today 2018-03-28...
PT-2006-5180 · Mambo · Contacts Xtd +1
Name of the Vulnerable Software and Affected Versions: Mambo component com contxtd affected versions not specified Description: A remote file inclusion issue in the Contacts XTD ContXTD component for Mambo allows remote attackers to potentially execute arbitrary PHP code via a URL in the mosConfi...
уязвимость в Sad Raven's guestbook
доброе время суток. Недавно я нашел уязвимость в Sad Raven's guestbook версии 1.1, которая позволяет любому пользователю получить доступ в админ-центр. Заранее прошу извинить, если эту уязвимость уже кто-то нашел, но я не нашел нигде о ней никакого упоминания. Все говорят только о том, что пароли...