529 matches found
CVE-2019-8389
The CVE-2019-8389 issue affects Musicloud 1.6, where the Wi‑Fi transfer feature runs a service on port 8080 accessible to any device on the same network. Affected component is the download.script endpoint, which processes POST parameters downfiles and cur-folder. A crafted ../ payload enables an ...
Fedora 29 : phpMyAdmin (2019-09ae31d880)
Upstream announcement: Security fix: phpMyAdmin 4.8.5 is released The phpMyAdmin team announces the release of phpMyAdmin version 4.8.5. Among other bug fixes, this contains several important security fixes. Upgrading is highly recommended for all users. The security fixes involve : - Arbitrary...
Fedora 28 : phpMyAdmin (2019-6cfd17b03d)
Upstream announcement: Security fix: phpMyAdmin 4.8.5 is released The phpMyAdmin team announces the release of phpMyAdmin version 4.8.5. Among other bug fixes, this contains several important security fixes. Upgrading is highly recommended for all users. The security fixes involve : - Arbitrary...
Arbitrary File Deletion, File Read Vulnerability in Ectouch WechatController Backend
ECTouch is a mobile mall online store system launched by Shanghai Shangchuang Network Technology Co. Ectouch WechatController backend exists arbitrary file deletion, file reading vulnerability. Attackers can use the vulnerability to reinstall the system and obtain configuration files...
S-CMS File Read Vulnerability
S-CMS is a content management system CMS based on PHP and MySQL. A file read vulnerability exists in the admin/download.php file in S-CMS version 1.0, which can be exploited by an attacker to read files with the help of the 'DownName' parameter...
CVE-2018-20463
Summary: CVE-2018-20463 affects WordPress- JSmol2WP plugin,
Microsoft Windows - MsiAdvertiseProduct Arbitrary File Read Exploit
Exploit for windows platform in category local exploits The bug is in “MsiAdvertiseProduct” Calling this function will result in a file copy by the installer service. This will copy an arbitrary file that we can control with the first parameter into c:\windows\installer … a check gets done while...
CVE-2018-19039
Grafana CVE-2018-19039 affects Grafana before 4.6.5 and 5.x before 5.3.3, allowing remote authenticated users with Editor or Admin perms to read arbitrary files. Root cause is a file-read exposure via dashboards/editors. Upgrading to Grafana 4.6.5 or 5.3.3+ mitigates the issue; check vendor advis...
CVE-2018-19748
app/plug/attachment/controller/admincontroller.php in SDCMS 1.6 allows reading arbitrary files via a /?m=plug&c=admin&a=index&p=attachment&root= directory traversal. The value of the root parameter must be base64 encoded note that base64 encoding, instead of URL encoding, is very rare in a...
Huawei Cloud RDS service suffers from arbitrary file read vulnerability
Huawei Cloud RDS Service is a specialized high-performance and highly reliable cloud database service provided by Huawei Technologies Co. An arbitrary file read vulnerability exists in Huawei Cloud RDS Service, which can be exploited by an attacker to read arbitrary files...
Design/Logic Flaw
An issue was discovered in BageCMS 3.1.3. The attacker can execute arbitrary PHP code on the web server and can read any file on the web server via an index.php?r=admini/template/updateTpl&filename= URI...
CVE-2018-15697
ASUSTOR Data Master (ADM) prior to version 3.1.6 is affected by CVE-2018-15697. Authenticated non-administrative users can read any file on a shared NAS by supplying the full path in the request (example: /home/admin/.ash_history). The issue stems from a file-disclosure vulnerability in ADM 3.1.5...
Jenkins < 2.133 and < 2.121.2 LTS Multiple Vulnerabilities - Windows
Jenkins is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2018-3766
The CVE-2018-3766 issue affects the buttle module for Node.js, where versions
OneFileCMS Information Disclosure Vulnerability
OneFileCMS is a lightweight CMS system. The system runs on PHP and JavaScript and includes features such as document editing, file uploading and file management. A security vulnerability exists in the onefilecms.php file in OneFileCMS 2017-10-08 and earlier versions. An attacker can exploit the...
CVE-2018-3724
general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read content of any file with known path...
CVE-2015-9538
creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wpnextgengalleyfileread.rb 2024-02-28 10:41:08+00:00| seen| https://t.me/ctinow/195303 2025-10-23 21:12:58+00:00| seen|...
Arbitrary file read vulnerability in cms made simple backend for normal users
CMS Made Simple is an open source content management system. It is built using PHP and Smarty Engine , which separates content , functionality and templates . cms made simple version 2.2.7 version of the background for file preview there is an arbitrary file read vulnerability , an attacker can...
CVE-2017-16786
The CVE-2017-16786 issue affects Meinberg LANTIME Web Configuration Utility on devices with firmware prior to 6.24.004. The vulnerability allows remote, authenticated users with certain privileges to read arbitrary files via (1) the ntpclientcounterlogfile parameter to cgi-bin/mainv2, or (2) vect...