CVE-2018-13812: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15 Update 4, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15 Update 4, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F All versions V15 Update 4, SIMATIC WinCC Runtime...

PT-2018-12198

Name of the Vulnerable Software and Affected Versions SIMATIC HMI Comfort Panels 4" - 22" versions prior to V15 Update 4 SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions prior to V15 Update 4 SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F versions prior to V15 Upda...

CVE-2018-20094

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

CVE-2018-20094: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

PT-2018-15254

Name of the Vulnerable Software and Affected Versions XXL-CONF version 1.6.0 Description The issue is related to a path traversal vulnerability via ../ in the keys parameter, which can be used to download any configuration file. This is associated with ConfController.java and PropUtil.java...

WordPress CodeCanyon-5293356-Ajax-Store-Locator-Wordpress 1.2.0 Disclosure

Exploit Title : WordPress CodeCanyon-5293356-Ajax-Store-Locator-Wordpress Plugins 1.2.0 Multiple Vulnerabilities Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 10/12/2018 Vendor Homepage : wordpress.org codecanyon.net/item/ajax-store-locator-v-20/4106209?srank=1 ...

Arbitrary File Download Vulnerability in Sunnyprint's Material Management System

Sunshine Printing is an enterprise non-core affairs procurement platform, providing one-stop procurement services for customized products required in office, marketing, packaging and logistics, business gifts and other scenarios for enterprise users. There is an arbitrary file download...

ASUSTOR ADM Path Traversal Vulnerability

ASUSTOR ADM is an operating system from ASUSTOR dedicated to ASUSTOR NAS storage devices. A directory traversal vulnerability exists in the downloadwallpaper.cgi file in ASUSTOR ADM version 3.1.1. An attacker can exploit this vulnerability by manipulating the 'file' and 'folder' URL parameters to...

CVE-2018-12314

Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters...

Arbitrary File Download Vulnerability in 56iq Digital Signage Software Frontend

56iq digital signage software is a digital signage content creation software, used to create exciting programs in plasma liquid crystal LCD flat-panel TVs, LED screens, projection equipment and other multimedia terminals playback and touch interactive applications. An arbitrary file download...

Microsoft Lync for Mac 2011 - Injection Forced BrowsingDownload

Microsoft Lync for Mac 2011 - Injection Forced BrowsingDownload Exploit Title: Microsoft Lync for Mac 2011 Injection Forced Browsing/Download Author: @nyxgeek - TrustedSec Date: 2018-03-20 Vendor Homepage: microsoft.com Software Link: https://www.microsoft.com/en-us/download/details.aspx?id=36517...

CVE-2018-12314: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters...

PT-2018-11113

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to download arbitrary files by manipulating the file and folder URL parameters in the downloadwallpaper.cgi. Recommendations For ASUSTOR ADM version 3.1.1, consider restricting...

KPOT Botnet Arbitrary File Disclosure

Exploit Title: KPOT Botnet - File Download/Source Code Disclosure Vulnerability Google Dork: n/a Date: 26/11/2018 Exploit Author: n4pst3r Vendor Homepage: unkn0wn Software Link: https://bhf.io/threads/515432/ Version: unkn0wn Tested on: Windows 10, debian 7 CVE : n/a Vuln-Code: download.php PoC:...

KPOT Botnet - File Download/Source Code Disclosure Vulnerability

Exploit for php platform in category web applications Exploit Title: KPOT Botnet - File Download/Source Code Disclosure Vulnerability Google Dork: n/a Date: 26/11/2018 Exploit Author: n4pst3r Vendor Homepage: unkn0wn Software Link: https://bhf.io/threads/515432/ Version: unkn0wn Tested on: Window...

Input validation

In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization during file downloads...

CVE-2018-9072

In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization during file downloads...

CVE-2018-9072

In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization during file downloads...

CVE-2018-9072

CVE-2018-9072 affects LXCI for VMware (versions prior to 5.5). Authenticated users can download any system file due to insufficient input sanitization during file downloads. The NVD entry confirms the flaw and impact; Lenovo advisory LEN-23800 specifies remediation: update to LXCI for VMware vers...

CVE-2018-9072: Improper Input Validation

In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization during file downloads...