Design/Logic Flaw

CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...

CVE-2019-17629

CMS Made Simple (CMSMS) 2.2.11 is affected by a stored cross‑site scripting (XSS) flaw. An admin can inject malicious content via a crafted image filename in the file manager > upload images screen, which is stored and later rendered in the application. The root cause is not explicitly detaile...

CVE-2019-17629: Improper Neutralization of Input During Web Page Generation

CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...

PT-2019-15237

Name of the Vulnerable Software and Affected Versions CMS Made Simple versions 2.2.11 Description The issue allows for stored XSS by an admin via a crafted image filename on the "file manager upload images" screen. Recommendations For version 2.2.11, update to a newer version that contains a fix...

Fly-start-panel Component Unauthorized Access

The vulnerability of the fly-start-panel component in the FLY operating system environment of the Astra Linux system is related to the ability to switch to a higher level in the file system through the “Start Menu” and file manager programs. Exploiting this vulnerability can allow an intruder to...

CVE-2019-11380

The CVE-2019-11380 issue affects the Android app ES File Explorer File Manager (version 4.2.0.1.3). The master-password protection can be bypassed via the com.estrongs.android.pop.ftp.ESFtpShortcut intent, which leads to remote FTP access to the user’s entire local storage. This vulnerability is ...

PT-2019-12270

Name of the Vulnerable Software and Affected Versions ES File Explorer File Manager application version 4.2.0.1.3 Description The master-password feature in the ES File Explorer File Manager application can be bypassed, allowing remote FTP access to the entirety of local storage. This can be...

CVE-2019-11380: Undefined Security Weakness

The master-password feature in the ES File Explorer File Manager application 4.2.0.1.3 for Android can be bypassed via a com.estrongs.android.pop.ftp.ESFtpShortcut intent, leading to remote FTP access to the entirety of local storage...

Cross-site Scripting (XSS)

Bolt is vulnerable to cross-site scripting XSS. The vulnerability exists due to lack of proper handling of Create file for system log in file manager, allowing a remote attacker to inject arbitrary Javascript into a victim's browser through the affected parameters...

CVE-2019-15091

filemgr.php in Artica Integria IMS 5.0.86 allows index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload arbitrary file upload...

CVE-2019-13385

CVE-2019-13385 affects CentOS Web Panel 0.9.8.840 (CWP). The vulnerability is an Information Disclosure in the filemanager component, allowing an attacker to enumerate users and identify active users by reading the /tmp/login.log. The exploitation context observed in external sources confirms use...

PT-2019-13306 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.846 Description: The issue allows attackers to steal a cookie or session, or redirect to a phishing website through Reflected XSS in the filemanager2.php file, specifically targeting the fm current dir parameter...

fly-mineapps File Manager Type Association DoS

The vulnerability of the fly-mineapps file manager’s type association utility is caused by buffer overflow during the processing of command-line parameters. Exploiting this vulnerability can allow an attacker to cause a service failure by entering a specially crafted sequence of data in the comma...

CVE-2019-13493

In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript...

CVE-2019-13493

In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript...

Cross site scripting

In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript...

CVE-2019-13493

Sitecore 9.0 rev 171002 is affected by a Persistent XSS in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript. This CVE (CVE-2019-13493) is documented across multiple sources (NVD/Red Hat/CVE listi...

CVE-2019-13493

In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript...

CVE-2019-13493: Improper Neutralization of Input During Web Page Generation

In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript...

PT-2019-13367

Name of the Vulnerable Software and Affected Versions Sitecore version 9.0 rev 171002 Description The issue exists in the Media Library and File Manager of the affected software, where an authenticated unprivileged user can inject arbitrary JavaScript by modifying the uploaded file extension...