885 matches found
CVE-2019-14766
CVE-2019-14766 affects DIMO YellowBox CRM prior to version 6.3.4. The issue is a path traversal vulnerability in the file browser that allows a standard authenticated user to browse the server filesystem. Based on the connected Red Hat/NVD entries, the vulnerability is triggered via the file brow...
CVE-2019-14768: Improper Limitation of a Pathname to a Restricted Directory
An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to deploy a new WebApp WAR file to the Tomcat server via Path Traversal, allowing remote code execution with SYSTEM privileges...
CVE-2019-14766: Improper Limitation of a Pathname to a Restricted Directory
Path Traversal in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to browse the server filesystem...
PT-2020-9601
Name of the Vulnerable Software and Affected Versions DIMO YellowBox CRM versions prior to 6.3.4 Description The issue allows a standard authenticated user to browse the server filesystem due to a path traversal vulnerability in the file browser. Recommendations For versions prior to 6.3.4, updat...
Dokeos 1.8.6.1 / 1.8.6.3 Arbitrary File Upload
Exploit Title: Dokeos 1.8.6.3 and 1.8.6.1- Arbitrary File Upload Google Dork: "Plateforme Dokeos 1.8.6.3 " or 1.8.6.1 Date: 17/09/2019 Exploit Author: Sohel Yousef Jellyfish security team Vendor Homepage: https://www.dokeos.com/ Software Link: https://www.dokeos.com/ Version: 1.8.6.3 - 1.8.6.1...
WordPress ckeditor-for-wordpress plugin cross-site scripting vulnerability
WordPress is a set of blogging platform developed by WordPress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. ckeditor-for-wordpress is an editor plugin used in it. A cross-site scripting vulnerability exists in the 'built-in old...
CVE-2015-9349
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in old" file browser...
Cross site scripting
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in old" file browser...
CVE-2015-9349
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in old" file browser...
PT-2019-7308
Name of the Vulnerable Software and Affected Versions ckeditor-for-wordpress plugin versions prior to 4.5.3.1 Description The issue concerns reflected XSS in the "built-in old" file browser. Recommendations For versions prior to 4.5.3.1, update to version 4.5.3.1 or later to resolve the issue...
CVE-2015-9349: Improper Neutralization of Input During Web Page Generation
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in old" file browser...
CVE-2019-14986
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command as well as "Set root password" are exposed...
CVE-2019-14986
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command as well as "Set root password" are exposed...
Design/Logic Flaw
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command as well as "Set root password" are exposed...
CVE-2019-14986
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command as well as "Set root password" are exposed...
PT-2019-13913
Name of the Vulnerable Software and Affected Versions eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn versions prior to 2.3.0 Description The issue allows administrative operations to be performed by unauthenticated attackers who have access to the web interface. This is because certain features...
CVE-2018-12299
Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names...
GodOfWar - Malicious Java WAR Builder With Built-In Payloads
A command-line tool to generate war payloads for penetration testing / red teaming purposes, written in ruby. Features Preexisting payloads. try -l/--list cmdget filebrowser bindshell reverseshell reverseshellui Configurable backdoor. try --host/-port Control over payload name. To avoid malicious...
Directory traversal
A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files...