Argus Surveillance DVR 4.0.0.0 - Directory Traversal

Argus Surveillance DVR 4.0.0.0 - Directory Traversal Exploit: Argus Surveillance DVR 4.0.0.0 - Directory Traversal Author: John Page aka hyp3rlinx Date: 2018-08-28 Vendor: www.argussurveillance.com Software Link: http://www.argussurveillance.com/download/DVRstp.exe CVE: N/A Description: Argus...

Argus Surveillance DVR 4.0.0.0 Directory Traversal Vulnerability

Exploit for cgi platform in category web applications + Credits: John Page aka hyp3rlinx + Source: http://hyp3rlinx.altervista.org/advisories/ARGUS-SURVEILLANCE-DVR-v4-UNAUTHENTICATED-PATH-TRAVERSAL-FILE-DISCLOSURE.txt + ISR: Apparition Security Greetz: Greetz: indoushka | Eduardo | GGA Vendor...

Argus Surveillance DVR 4.0.0.0 - Directory Traversal

Exploit: Argus Surveillance DVR 4.0.0.0 - Directory Traversal Author: John Page aka hyp3rlinx Date: 2018-08-28 Vendor: www.argussurveillance.com Software Link: http://www.argussurveillance.com/download/DVRstp.exe CVE: N/A Description: Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated...

Argus Surveillance DVR 4.0.0.0 Directory Traversal

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ARGUS-SURVEILLANCE-DVR-v4-UNAUTHENTICATED-PATH-TRAVERSAL-FILE-DISCLOSURE.txt + ISR: Apparition Security Greetz: Greetz: indoushka | Eduardo | GGA Vendor...

ASUSTOR ADM < 3.1.6 Multiple Vulnerabilities

ASUSTOR ADM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:asustor:adm"; if description...

ASUSTOR Data Master File Disclosure Vulnerability

ASUSTOR Data Master ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. A file disclosure vulnerability exists in ASUSTOR ADM 3.1.5 and earlier versions. A remote attacker can exploit this vulnerability by sending a request to the downloadwallpaper.cgi file and...

ASUSTOR Data Master < 3.1.6 Multiple Vulnerabilities

According to its self-reported version number, the ASUSTOR Data Master ADM web interface running on the remote web server is prior to 3.1.6. It is, therefore, affected by multiple vulnerabilities: - CVE-2018-15694: Authenticated File Upload - CVE-2018-15695: Authenticated Arbitrary File Deletion ...

Ghostscript - Multiple Vulnerabilities

Exploit for linux platform in category local exploits http://seclists.org/oss-sec/2018/q3/142 These are critical and trivial remote code execution bugs in things like ImageMagick, Evince, GIMP, and most other PDF/PS tools. ---- Hello, this was discussed on the distros list, but it was suggested t...

LibreHealthIO LH-EHR Local File Disclosure Vulnerability

LibreHealthIO LH-EHR is an open source electronic health record and medical practice management application. A local file disclosure vulnerability exists in the import of templates in versions prior to LibreHealthIO LH-EHR REL-2.0.0. An attacker can exploit this vulnerability to disclose sensitiv...

Ghostscript - Multiple Vulnerabilities

Ghostscript - Multiple Vulnerabilities http://seclists.org/oss-sec/2018/q3/142 These are critical and trivial remote code execution bugs in things like ImageMagick, Evince, GIMP, and most other PDF/PS tools. ---- Hello, this was discussed on the distros list, but it was suggested to move discussi...

Canadian Telcos Patch an APT-Ready Flaw in Disability Services

Canadian telcos have patched a widespread local file-disclosure flaw in disability services that allow people who are deaf, hard of hearing, or have a speech disorder to place calls through a text telephone or other assistive devices. The vulnerability opens the door for widespread attacks on...

CVE-2018-1000645

LibreHealthIO lh-ehr version REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure that can result in Disclosure of sensitive files on the server. This attack appear to be exploitable via User controlled variable in import...

CVE-2018-1000645

LibreHealthIO lh-ehr version REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure that can result in Disclosure of sensitive files on the server. This attack appear to be exploitable via User controlled variable in import...

Arbitrary file deletion

LibreHealthIO lh-ehr version REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure that can result in Disclosure of sensitive files on the server. This attack appear to be exploitable via User controlled variable in import...

CVE-2018-1000645

LibreHealthIO lh-ehr version REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure that can result in Disclosure of sensitive files on the server. This attack appear to be exploitable via User controlled variable in import...

CVE-2018-1000645

CVE-2018-1000645 affects LibreHealthIO lh-ehr prior to REL-2.0.0. The vulnerability is an Authenticated Local File Disclosure in the Importing of templates feature, where a user-controlled variable in the import templates function can disclose sensitive server files. This is documented across mul...

TP-Link File Disclosure Vulnerability

Multiple TP-Link devices are prone to a file disclosure vulnerability where an unauthenticated attacker may obtain the configuration backup file which may contain sensitive data e.g. admin password which could lead to complete compromise of the device. Copyright C 2018 Greenbone Networks GmbH Som...

OpenEMR File Disclosure

File disclosure vulnerability in OpenEMR importtemplate.php docid parameter Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

spark: Absolute and relative pathnames allow for unintended static file disclosure

In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark...

CVE-2018-12408

The BusinessWorks engine component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks, TIBCO ActiveMatrix BusinessWorks for z/Linux, and TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric contains a vulnerability that may allow XML eXternal Entity XXE attacks via incomin...