CVE-2018-13980

The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal...

CVE-2018-13980

Zeta Producer Desktop CMS versions prior to 14.2.1 are vulnerable to unauthenticated file disclosure and local file inclusion when the filebrowser plugin is installed. The root cause is a directory traversal vulnerability in assets/php/filebrowser/filebrowser.main.php?file=../. An attacker can ex...

PT-2018-12258

Name of the Vulnerable Software and Affected Versions Zeta Producer Desktop CMS versions prior to 14.2.1 Description The issue allows for unauthenticated file disclosure when the filebrowser plugin is installed. This is due to a directory traversal vulnerability in the...

Zeta Producer Desktop CMS Local File Disclosure Vulnerability

Zeta Producer Desktop CMS a content management system. A local file disclosure vulnerability exists in Zeta Producer Desktop CMS, which allows an unauthenticated attacker to read local files by exploiting a path traversal issue...

CVE-2018-13980: Improper Limitation of a Pathname to a Restricted Directory

The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal...

Zeta Producer Desktop CMS 14.2.0 Code Execution / File Disclosure Vulnerabilities

Zeta Producer Desktop CMS versions 14.2.0 and below suffers from code execution and file disclosure vulnerabilities. ======================================================================= title: Remote Code Execution & Local File Disclosure product: Zeta Producer Desktop CMS vulnerable version:...

Zeta Producer Desktop CMS 14.2.0 - Remote Code Execution Local File Disclosure

Zeta Producer Desktop CMS 14.2.0 - Remote Code Execution Local File Disclosure SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Remote Code Execution & Local File Disclosure product: Zeta Producer Desktop CMS vulnerable...

Zeta Producer Desktop CMS 14.2.0 - Remote Code Execution / Local File Disclosure

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Remote Code Execution & Local File Disclosure product: Zeta Producer Desktop CMS vulnerable version: =14.2.1 CVE number: CVE-2018-13981, CVE-2018-13980 impact: critical...

Zeta Producer Desktop CMS 14.2.0 Code Execution / File Disclosure

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Remote Code Execution & Local File Disclosure product: Zeta Producer Desktop CMS vulnerable version: =14.2.1 CVE number: CVE-2018-13981, CVE-2018-13980 impact: critical...

WordPress file-away plugin file disclosure vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A file disclosure vulnerability exists in the WordPress file-away plugin, which can be exploited by attackers to download fil...

Symantec Messaging Gateway 10.6.1 File Disclosure

File disclosure vulnerability in Symantec Messaging Gateway com.ve.kavachart.servlet.ChartStream sn parameter Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Node.js 8.5.0 Path Traversal File Disclosure

File disclosure vulnerability in Node.js Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

uWSGI Path Traversal File Disclosure

File disclosure vulnerability in uWSGI Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Microsoft Windows EMET XML External Entity Injection Vulnerability

Microsoft Windows 10 and others are a series of operating systems released by the American company Microsoft Microsoft, Enhanced Mitigation Experience Toolkit is a free security toolkit for Microsoft Windows. An XML external entity injection vulnerability exists in Microsoft Windows EMET, which...

Adminer script versions up to 4.6.2 contains file disclosure vulnerability

More info at https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability...

PT-2018-6347

Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye and Crucible versions prior to 4.3.2 Atlassian Fisheye and Crucible versions 4.4.0 through 4.4.2 Atlassian Fisheye and Crucible versions prior to 4.5.0 Description: The issue allows remote attackers to read files contained...

Adminer script versions up to 4.6.2 contains file disclosure vulnerability

More info at https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability...

PT-2018-11466 · Webgrind · Webgrind

Name of the Vulnerable Software and Affected Versions: Webgrind version 1.5 Description: The issue allows anyone to view files from the local filesystem that the webserver user has access to. This is achieved by manipulating the file parameter in the /index.php API endpoint, specifically through...

spark: Absolute and relative pathnames allow for unintended static file disclosure

In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark...

CVE-2018-1000548

Umlet version 14.3 contains a XML External Entity XXE vulnerability in File parsing that can result in disclosure of confidential data, denial of service, server side request forgery. This attack appear to be exploitable via Specially crafted UXF file. This vulnerability appears to have been fixe...