VulnCheck KEV: CVE-2023-25280

D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the pingaddr parameter to ping.ccp...

dir-shop.cz Cross Site Scripting vulnerability OBB-3455485

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-5278 · D Link · D-Link Dir-645

Name of the Vulnerable Software and Affected Versions: D-Link DIR-645 version 1.03 Description: The issue is related to an Authentication Bypass vulnerability that allows remote attackers to gain escalated privileges. This is due to insufficient access control in the phpcgi main function in cgibi...

PT-2023-11588 · Unknown · Nucleus Cms

Name of the Vulnerable Software and Affected Versions: NucleusCMS version 3.71 Description: The issue allows a remote attacker to execute arbitrary code. This is achieved via the "https://example.com/nucleus/plugins/skinfiles/?dir=rsd" API endpoint, where the dir parameter is set to rsd...

CVE-2020-21474: Unrestricted Upload of File with Dangerous Type

File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rsd parameter...

dir-shop.cz Cross Site Scripting vulnerability OBB-3444986

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of D-Link DIR-842V2 router’s microprogramming software, related to the lack of measures taken to clean data at the control level, allows attackers to execute arbitrary commands.

The vulnerability of D-Link DIR-842V2 router microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by importing a specially created binary file...

DEBIAN-CVE-2023-2976

Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files...

CVE-2023-34878

An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip...

CVE-2023-34878

An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip...

CVE-2023-3231

A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic. This vulnerability affects unknown code of the component ZIP Package Handler. The manipulation of the argument dir leads to information disclosure. The attack can be initiated remotely. The complexity of an attack ...

UJCMS 安全漏洞

UJCMS is UJCMS open source a Java open source content management system . A security vulnerability exists in UJCMS v6.0.2. An attacker exploited the vulnerability to obtain sensitive information via the dir parameter of /api/backend/core/web-file-html/download-zip...

D-Link DIR-600 Buffer Overflow Vulnerability

The D-Link DIR-600 is a wireless router from China's AUO D-Link. A buffer overflow vulnerability exists in the D-Link DIR-600 version 2.18, which originates from a boundary error in the file gena.cgi when processing untrusted input, and can be exploited by an attacker to execute arbitrary code on...

D-Link DIR-600 Command Injection Vulnerability

The D-Link DIR-600 is a wireless router from China's AUO D-Link. The D-Link DIR-600 suffers from a command injection vulnerability that stems from the ST parameter in the lxmldbcsystem function failing to properly filter construct command special characters, commands, and so on. An attacker can...

PT-2023-25044 · Ujcms · Ujcms

Name of the Vulnerable Software and Affected Versions: Ujcms version 6.0.2 Description: An issue in Ujcms allows attackers to gain sensitive information via the dir parameter to the "/api/backend/core/web-file-html/download-zip" API endpoint. Recommendations: For Ujcms version 6.0.2, as a tempora...

CVE-2023-34878: Observable Discrepancy

An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip...

CVE-2023-34878

An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip...

CVE-2023-34878

An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip...

CVE-2023-3231: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic. This vulnerability affects unknown code of the component ZIP Package Handler. The manipulation of the argument dir leads to information disclosure. The attack can be initiated remotely. The complexity of an attack ...

PT-2023-23719 · Ujcms · Ujcms

Name of the Vulnerable Software and Affected Versions: UJCMS versions up to 6.0.2 Description: A vulnerability has been found in the ZIP Package Handler component of UJCMS, which can lead to information disclosure through the manipulation of the dir argument. The attack can be initiated remotely,...