CVE-2018-7204

inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. If a user edits the wp-config.php file using this plugin, the wp-config.php contents get added to log.txt, which is not protected and...

Information disclosure

File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station before 8.1.2-5469 allows remote authenticated users to obtain other user's sensitive files via the filename parameter...

CVE-2017-16770

CVE-2017-16770 affects Synology Surveillance Station, specifically SYNO.SurveillanceStation.PersonalSettings.Photo. Affected: Surveillance Station before 8.1.2-5469. Issue: file and directory information disclosure; remote authenticated users can obtain other users’ sensitive files via the filena...

CVE-2018-7272

The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file...

CVE-2017-18192

smart/calculator/gallerylock/CalculatorActivity.java in the "Photo,Video Locker-Calculator" application through 18 for Android allows attackers to access files via the backdoor 17621762 PIN...

File Exposure

oozie-core is vulnerable to file exposure. Using a XML directives within a XML workflow file, attackers can expose private/sensitive files within the Oozie server...

CVE-2018-1053

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pgupgrade creates file in current working directory containing the output of pgdumpall -g under umask which was in effect when the user invoked pgupgrade, and not under 0077 which...

EulerOS 2.0 SP1 : xdg-user-dirs (EulerOS-SA-2018-1024)

According to the version of the xdg-user-dirs package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that the system umask policy is not being honored when creating XDG user directories /Desktop etc on first login. This could lea...

CVE-2017-5260

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference DRO at...

Design/Logic Flaw

Password file exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to execute arbitrary commands with administrative privileges by retrieving credentials from this file...

CVE-2017-13664

CVE-2017-13664 affects iSmartAlarm CubeOne firmware prior to 2.2.4.8. The issue: a password file exposure in the firmware enables an attacker to retrieve credentials and execute arbitrary commands with administrative privileges. Impact described as arbitrary command execution with admin rights, e...

CVE-2017-13664

Password file exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to execute arbitrary commands with administrative privileges by retrieving credentials from this file...

CVE-2017-13701

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The backup file contains sensitive information in a insecure way. There is no salt for password hashing. Indeed passwords are stored without being ciphered with a timestamped ciphering method...

PT-2017-14623 · Taylor Otwell · Laravel

Name of the Vulnerable Software and Affected Versions: Laravel framework versions prior to 5.5.22 Description: The issue allows remote attackers to obtain sensitive information, such as externally usable passwords, via a direct request for the /.env URI. This is due to the...

UBUNTU-CVE-2017-1000382

VIM version 8.0.1187 and other versions most likely ignores umask when creating a swap file "ORIGINALFILENAME.swp" resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary...

Afian AB FileRun 2017.03.18 - Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Afian AB FileRun vulnerable version: 2017.03.18 fixed version: 2017.09.18 impact: critical homepage: https://www.filerun.com |...

Code injection

IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user within a short timespan. IBM X-Force ID: 126461...

CVE-2017-1346

IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user within a short timespan. IBM X-Force ID: 126461...

CVE-2017-1346

IBM BPM CVE-2017-1346 affects IBM Business Process Manager versions 7.5.0.0–7.5.1.2, 8.0.0.0–8.0.1.3, 8.5.0.0–8.5.0.2, 8.5.5.0, 8.5.6.0–8.5.6.0 CF2, and 8.5.7.x. The vulnerability arises because the product temporarily stores files in a temporary/shared directory during offline installs, which a ...

CVE-2017-1346

IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user within a short timespan. IBM X-Force ID: 126461...