Dragnmove

Dragnmove Dragnmove est un outil de post-exploitation qui infecte les fichiers partagés entre les utilisateurs afin de passer d'un système à un autre. Dragnmove peut détecter des actions telles que le dépôt d'un fichier dans la fenêtre du navigateur ou la pièce jointe d'un fichier à un client de...

Arbitrary File Upload

Overview ci4-cms-erp/ci4ms is a composer create-project ci4-cms-erp/ci4ms Affected versions of this package are vulnerable to Arbitrary File Upload via the createFile and save endpoints. An attacker can execute arbitrary code on the server by creating a file with a dangerous extension and injecti...

A deep dive into MUTZ

AtDEF CON 33, we shared our research into MapUrlToZone, a critical Windows security component that determines whether a given path is local, on the intranet, or on the broader Internet. This classification drives several security decisions across Windows, for example, preventing a CreateFile call...

EUVD-2019-0744

Malware in sbrugna...

EUVD-2007-3386

Malware in sbrugna...

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php

...

CVE-2024-42481

CVE-2024-42481 affects the Skyport Daemon (skyportd) used with Skyport Panel. The root cause is lack of rate limiting on createFolder and createFile, enabling exploitation by creating thousands of folders/files which can drive 100% CPU usage and cause an Out-of-Memory condition, potentially crash...

The vulnerability of the CreateFile method in the SolarWinds Access Rights Manager software allows a perpetrator to execute arbitrary code.

The vulnerability of the CreateFile method in the SolarWinds Access Rights Manager ARM access control software lies in improper restrictions on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

SolarWinds Access Rights Manager CreateFile Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CreateFile method. The issue results from the lack of proper...

PT-2024-4872 · Solarwinds · Solarwinds Access Rights Manager

Name of the Vulnerable Software and Affected Versions: SolarWinds Access Rights Manager affected versions not specified Description: The issue is related to the CreateFile method in SolarWinds Access Rights Manager, which is susceptible to a directory traversal vulnerability. This vulnerability c...

CVE-2020-15779

A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path...

CVE-2020-15779: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path...

GHSA-9H4G-27M8-QJRG Path Traversal in socket.io-file

All versions of socket.io-file are vulnerable to Path Traversal. The package fails to sanitize user input and uses it to generate the file upload paths. The socket.io-file::createFile message contains a name option that is passed directly to path.join. It is possible to upload files to arbitrary...

PT-2020-14625

Name of the Vulnerable Software and Affected Versions socket.io-file versions through 2.0.31 Description A Path Traversal issue was discovered in the socket.io-file package for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename...

GHSA-CJ8P-53V9-2C26 Cross-site Scripting in Bolt

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

Cross-site Scripting in Bolt

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

CVE-2019-15485

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

CVE-2019-15485

CVE-2019-15485: Bolt before 3.6.10 is vulnerable to cross-site scripting via createFolder or createFile in Controller/Async/FilesystemManager.php. The issue affects Bolt CMS versions prior to 3.6.10 and is exploitable through crafted input in file/folder creation paths, as documented in multiple ...

PT-2019-14214

Name of the Vulnerable Software and Affected Versions Bolt versions prior to 3.6.10 Description The issue is related to cross-site scripting XSS that can occur via the createFolder or createFile functions in the Controller/Async/FilesystemManager.php file. Recommendations For versions prior to...

CVE-2019-15485: Improper Neutralization of Input During Web Page Generation

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...