5813 matches found
CVE-2021-23835
CVE-2021-23835 affects flatCore prior to 2.0.0 build 139. The issue is a local file disclosure in the docs_file HTTP request body parameter of the acp interface, which accepts malicious user input and can reveal sensitive backend files (e.g., /etc/passwd, SQLite DBs, PHP source) when an attacker ...
CVE-2021-23835
An issue was discovered in flatCore before 2.0.0 build 139. A local file disclosure vulnerability was identified in the docsfile HTTP request body parameter for the acp interface. This can be exploited with admin access rights. The affected parameter which retrieves the contents of the specified...
flatCore Information Disclosure Vulnerability
flatCore is a lightweight content management system CMS based on PHP and SQLite. An information disclosure vulnerability exists in flatCore CMS prior to version 2.0.0 build 139, which stems from a local file disclosure vulnerability found in the program's docsfile acp interface's HTTP request bod...
flatCore 输入验证错误漏洞
flatCore is a lightweight content management system CMS based on PHP and SQLite. An information disclosure vulnerability exists in flatCore CMS prior to version 2.0.0 build 139, which stems from a local file disclosure vulnerability found in the program's docsfile acp interface's HTTP request bod...
flatCore CMS XSS / File Disclosure / SQL Injection
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: flatCore CMS vulnerable version: 2.0.0 Build 139 fixed version: Release 2.0.0 Build 139 CVE number: CVE-2021-23835, CVE-2021-23836,...
CVE-2020-26981
A vulnerability has been identified in JT2Go All versions V13.1.0, Teamcenter Visualization All versions V13.1.0. When opening a specially crafted xml file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the...
CVE-2020-26981
A vulnerability has been identified in JT2Go All versions V13.1.0, Teamcenter Visualization All versions V13.1.0. When opening a specially crafted xml file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the...
CVE-2020-26981
A vulnerability has been identified in JT2Go All versions V13.1.0, Teamcenter Visualization All versions V13.1.0. When opening a specially crafted xml file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the...
iBall-Baton WRA150N File Disclosure
Exploit Title: iBall-Baton WRA150N Rom-0 Backup - File Disclosure Sensitive Information Date: 07/01/2021 Exploit Author: h4cks1n Vendor Homepage: iball.co.in Version: iBall-Baton WRA150N Tested on : Windows 7/8/8.1/10, Parrot Linux OS The iBall-Baton router version WRA150N is vulnerable to the...
iBall-Baton WRA150N Rom-0 Backup - File Disclosure (Sensitive Information)
Exploit Title: iBall-Baton WRA150N Rom-0 Backup - File Disclosure Sensitive Information Date: 07/01/2021 Exploit Author: h4cks1n Vendor Homepage: iball.co.in Version: iBall-Baton WRA150N Tested on : Windows 7/8/8.1/10, Parrot Linux OS The iBall-Baton router version WRA150N is vulnerable to the...
camel: server-side template injection and arbitrary file disclosure on templating components
A flaw was found in camel. Camel's templating components are suseptable to Server-Side Template Injection and arbitrary file disclosure. The highest threat from this vulnerability is to data confidentiality...
CVE-2020-26831
SAP BusinessObjects BI Platform Crystal Report, versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file...
Server side request forgery (ssrf)
SAP BusinessObjects BI Platform Crystal Report, versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file...
CVE-2020-26831
SAP BusinessObjects BI Platform Crystal Report, versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file...
Siemens XHQ 信息泄露漏洞
Siemens XHQ is a software platform that aggregates plant or pipeline operational data, processes it in a goal-oriented manner, and then makes decisions in real time to effectively improve plant or pipeline operational performance. A relative path traversal vulnerability exists in Siemens XHQ...
UBUNTU-CVE-2020-29600
In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501...
TYPO3 Input Validation Error Vulnerability (CNVD-2020-65162)
TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. TYPO3 suffers from a security vulnerability that stems from insufficient validation of user-supplied XML input in RSS widgets, which can be exploited by a remote user to pass specially...
Citrix XenMobile Server File Disclosure
File disclosure vulnerability in Citrix XenMobile Server Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...
BigBlueButton 2.2.25 - Arbitrary File Disclosure and Server-Side Request Forgery
Exploit Title: BigBlueButton 2.2.25 - Arbitrary File Disclosure and Server-Side Request Forgery Date: 2020-09-11 Exploit Author: RedTeam Pentesting GmbH Vendor Homepage: https://bigbluebutton.org/ Version: BigBlueButton 2.2.25 RedTeam Pentesting discovered a vulnerability in the BigBlueButton web...