Cisco Identity Services Engine 安全漏洞

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform collects real-time information from networks, users, and devices to develop and enforce policies to regulate the network. A security vulnerability exists in...

The vulnerability of the CiviCRM web-based contact tracking and interaction management system lies in the lack of restrictions on file downloads. This allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the CiviCRM contact tracking and interaction management web system is related to the ability to upload and execute PHAR archives. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, and cause service failure...

The vulnerability of the Pulse Connect Secure corporate network VPN server, related to the unlimited download of dangerous types of files, allows a hacker to execute arbitrary code.

The vulnerability of the Pulse Connect Secure corporate network VPN server is related to the unlimited download of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by downloading a specially created archive through the web administrator interface...

The vulnerability of the prodViewUpdate.php implementation of the online e-commerce sales system allows a hacker to execute arbitrary code.

The vulnerability of the prodViewUpdate.php implementation in the online e-commerce website system is related to the unlimited downloading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the File Manager plugin (wp-file-manager) of the WordPress content management system allows a hacker to execute arbitrary PHP code on the target system.

The vulnerability of the File Manager plugin wp-file-manager in the WordPress content management system is related to the ability to download files of a dangerous type without limitation. Exploiting this vulnerability allows a malicious actor to execute any PHP code on the target system remotely...

Backdoor.Win32.Hupigon.gsy Unauthenticated Open Proxy

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/7e99aa748b61fd0802fa19cf9e4cf1f8.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Hupigon.gsy Vulnerability: Unauthenticated Open Proxy Description: The malware listen...

The vulnerability of the Admidio membership management and access control application lies in its ability to download files of a dangerous type without limitation, allowing a perpetrator to execute arbitrary code.

The vulnerability of the Admidio membership management and access control application lies in the ability to download unlimited files of a dangerous type. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code using specially created .phar files...

How to remove the File Transfer Tab in a Full VPN NetScaler Gateway

How to remove the "File Transfer" Tab to prevent users from downloading files when accessing the environment through the NetScaler Gateway...

The vulnerability of the module for creating and editing user-form templates of the “LOCMAN Designer Form” in the LOCMAN Product Lifecycle Management system lies in its ability to download files of a dangerous type indefinitely, allowing a perpetrator to execute arbitrary code.

The vulnerability of the module responsible for creating and editing user-form templates in the “LOZMAN Designer Form” component of the LOZMAN Product Lifecycle Management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow an attacker to execu...

InvoicePlane Path Traversal Vulnerability

InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. InvoicePlane version 1.5.11 suffers from a path traversal vulnerability that originates from a misconfigured web server that allows unauthenticated...

Arbitrary File Download Vulnerability in Dahua In-vehicle Comprehensive Management Platform of Zhejiang Dahua Technology Company Limited (CNVD-2021-35888)

Zhejiang Dahua Technology Co., Ltd. is a video-centered intelligent IOT solution provider and operation service provider. An arbitrary file download vulnerability exists in the Dahua vehicle integrated management platform of Zhejiang Dahua Technology Co. An attacker can exploit the vulnerability ...

The vulnerability of the online configuration software EcoStruxure Power Build lies in its ability to download unlimited amounts of dangerous files, allowing a hacker to execute arbitrary code.

The vulnerability of the online configuration software of EcoStruxure Power Build lies in the ability to download unlimited files of a malicious nature. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2020-35577

Endalia Selection Portal (before 4.205.0) is affected by an Insecure Direct Object Reference (IDOR) vulnerability. Authenticated users can download any uploaded file by altering the file identifier (CommonDownload ID). This is the root cause described across multiple sources linked to CVE-2020-35...

Cisco Multiple Routers Authorization Header Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Cisco RV16x and RV26x routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of file downloads. When parsing the Authorization...

FeiFeiCms is vulnerable to arbitrary file downloads

FeiFeiCms is a free and open source PHP movie program , focusing on providing , video on demand , film and television aggregation services. FeiFeiCms arbitrary file download vulnerability , attackers can exploit the vulnerability to download arbitrary files...

Cisco Security Manager Path Traversal Vulnerability

Cisco Security Manager CSM is a suite of enterprise-level management applications from Cisco that are used to configure firewall, VPN, and intrusion protection security services on Cisco network and security devices. A path traversal vulnerability exists in Cisco Security Manager 4.21 and earlier...

Konzept-iX PubliXone Information Disclosure Vulnerability

Konzept-iX PubliXone is a media production and document editing software from the German company Konzept-iX. PubliXone 2019.045 suffers from an information disclosure vulnerability that can cause cross-site scripting, account takeover, lack of access control, hard-coded keys, and file download...

Konzept-iX PubliXone Cross-Site Scripting Vulnerability

Konzept-iX PubliXone is a media production and document editing software from the German company Konzept-iX. A cross-site scripting vulnerability exists in Konzept-iX PubliXone version 2019.045, which exposes PubliXone to cross-site scripting, account takeover, lack of access control, hard-coded...

Konzept-iX PubliXone Encryption Problem Vulnerability

Konzept-iX PubliXone is a media production and document editing software from the German company Konzept-iX. Konzept-iX PubliXone version 2019.045 suffers from an encryption issue vulnerability that causes PubliXone to suffer from cross-site scripting, account takeover, lack of access control,...

The vulnerability of the AcyMailing email marketing manager lies in the lack of restrictions on file downloads, allowing attackers to execute arbitrary code.

The vulnerability of the AcyMailing email marketing manager is related to the lack of restrictions on file uploads. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...