PT-2022-17079

Name of the Vulnerable Software and Affected Versions HorizontCMS version 1.0.0-beta.2 Description The issue allows for an arbitrary file download via the /admin/file-manager/ component. Recommendations For version 1.0.0-beta.2, consider restricting access to the /admin/file-manager/ component...

CVE-2022-25104: Files or Directories Accessible to External Parties

HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/...

PT-2022-17264

Name of the Vulnerable Software and Affected Versions Cuppa CMS version 1.0 Description The issue allows attackers to gain read access to arbitrary files by copying any file to the current directory using the copy function of the file manager. Recommendations For Cuppa CMS version 1.0, consider...

openSUSE 15 Security Update : chromium (openSUSE-SU-2022:0042-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0042-1 advisory. - Use after free in File Manager. CVE-2022-0603 - Heap buffer overflow in Tab Groups. CVE-2022-0604 - Use after free in Webstore API...

Improper Access Control in File Manager module

Description In Webmin 1.984, any authenticated low privilege user who did not have access to the File Manager module could interact with a variety of file manager capabilities such as modifying file ownership chown, viewing file properties, listing or deleting files and directories on the server...

Use-After-Free

chromium is vulnerable to use-after-free. The vulnerability is possible because of a flaw in the component File Manager, leading to a memory corruption issue resulting in a use-after-free vulnerability...

CVE-2022-22914

An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal...

CVE-2022-22914

An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal...

Improper Access Control to Remote Code Execution

Description In Webmin v1.984, affecting File Manager module, any authenticated low privilege user without access rights to the File Manager module could interact with file manager functionalities such as download file from remote URL and change file permission chmod. It is possible to achieve...

PT-2022-1959 · Webmin +1 · Webmin +1

Name of the Vulnerable Software and Affected Versions: webmin versions prior to 1.990 Description: The issue is related to improper access control in the webmin repository, which can lead to remote code execution. This is due to weaknesses in the authorization mechanism of the File Manager module...

Tiny File Manager 2.4.3 Shell Upload Exploit

Tiny File Manager Example: ./exploit.sh http://files.ubuntu.local/index.php admin "email protected" https://github.com/febinrev/tinyfilemanager-2.4.3-exploit !/bin/bash check which curl if $? = 0 then printf "✔ Curl found! \n" else printf "❌ Curl not found! \n" exit fi which jq if $? = 0 then...

Chromium: CVE-2022-0603 Use after free in File Manager

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Google Chrome Resource Management Error Vulnerability (CNVD-2022-20558)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a resource management error vulnerability that stems from a release and reuse technique within the file manager component. A remote attacker could exploit this vulnerability to create a specially crafted w...

Tiny File Manager 2.4.3 Shell Upload

Tiny File Manager Example: ./exploit.sh http://files.ubuntu.local/index.php admin "admin@123" https://github.com/febinrev/tinyfilemanager-2.4.3-exploit !/bin/bash check which curl if $? = 0 then printf "✔ Curl found! \n" else printf "❌ Curl not found! \n" exit fi which jq if $? = 0 then printf "✔...

Chrome Zero-Day Under Active Attack: Patch ASAP

Google on Monday issued 11 security fixes for its Chrome browser, including a high-severity zero-day bug that’s actively being jumped on by attackers in the wild. In a brief update, Google described the weakness, tracked as CVE-2022-0609, as a use-after-free vulnerability in Chrome’s Animation...

Path Traversal in prasathmani/tinyfilemanager

Description A Path Traversal vulnerability exists in Tiny File Manager, which allows the upload of files to an arbitrary location in the server. This flaw derives from the way that the file upload/creation is handled when a file with the same name already exists in the target directory. Affected...

New Chrome 0-Day Bug Under Active Attack – Update Your Browser ASAP!

Google on Monday rolled out fixes for eight security issues in the Chrome web browser, including a high-severity vulnerability that's being actively exploited in real-world attacks, marking the first zero-day patched by the internet giant in 2022. The shortcoming, tracked CVE-2022-0609, is...

PT-2022-1716

Name of the Vulnerable Software and Affected Versions Google Chrome on Chrome OS versions prior to 98.0.4758.102 Description The issue is related to a use after free in the File Manager component, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a crafte...

FreeBSD : chromium -- multiple vulnerabilities (e12432af-8e73-11ec-8bc4-3065ec8fd3ec)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e12432af-8e73-11ec-8bc4-3065ec8fd3ec advisory. - Inappropriate implementation in Gamepad API in Google Chrome prior to 98.0.4758.102 allowed ...

Google Chrome < 98.0.4758.102 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 98.0.4758.102. It is, therefore, affected by multiple vulnerabilities as referenced in the 202202stable-channel-update-for-desktop14 advisory. - Inappropriate implementation in Gamepad API in Google Chrome prior to...