Remote code execution

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages to generate a valid cryptographic message authentication code HMAC-SHA1 - either by using a different existing vulnerability or in case t...

CVE-2020-15099

CVE-2020-15099 affects TYPO3 CMS versions 9.0.0–9.5.19 and 10.0.0–10.4.5. An attacker who can construct a valid HMAC-SHA1 can access arbitrary files (e.g., typo3conf/LocalConfiguration.php) containing the encryptionKey and DB credentials, enabling full DB access and potentially creating an admin ...

typo3 -- multiple vulnerabilities

Typo3 Team reports: In case an attacker manages to generate a valid cryptographic message authentication code HMAC-SHA1 - either by using a different existing vulnerability or in case the internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation. This...

Directory Traversal

spring-cloud-config-server is vulnerable to directory traversal. The vulnerability exists as it does not verify that the resources are served from allowed locations. An attacker is able to retrieve and read arbitrary system files using file:// or ../ characters...

Information Disclosure

curl is vulnerable to information disclosure. The wrong buffer is sent to the user when trying to obtain a file using file://. This can result in confidential information being disclosed...

CVE-2020-12478

TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files...

CVE-2020-12478

TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files...

CVE-2020-12478

TeamPass 2.1.27.36 is affected by CVE-2020-12478 due to improper authentication. An unauthenticated attacker can retrieve files from the web root, potentially exposing backups and LDAP debug files and enabling data exposure or unauthorized operations. The connected Nuclei template confirms the vu...

CVE-2020-12478

TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files...

Apache Tomcat Exploit Poised to Pounce, Stealing Files

A vulnerability in the popular Apache Tomcat web server is ripe for active attack, thanks to a proof-of-concept PoC exploit making an appearance on GitHub. The now-patched bug affects Tomcat versions 7.0, 8.5 and 9.0. According to Flashpoint analysts Cheng Lu and Steven Ouellette, an exploit for...

Apache Tomcat Exploit Poised to Pounce, Stealing Files

A vulnerability in the popular Apache Tomcat web server is ripe for active attack, thanks to a proof-of-concept PoC exploit making an appearance on GitHub. The now-patched bug affects Tomcat versions 7.0, 8.5 and 9.0. According to Flashpoint analysts Cheng Lu and Steven Ouellette, an exploit for...

CVE-2019-13195

The CVE-2019-13195 entry describes a path traversal vulnerability in the web application of Kyocera ECOSYS M5526CDW (e.g., 2R7_2000.001.701). The vulnerability allows an unauthenticated user to retrieve arbitrary files or check for file/folder existence outside a restricted directory due to insuf...

CVE-2020-1693

A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service, or in certain circumstances, execute...

XML External Entity (XXE) Injection Payload List

An XML External Entity XXE attack sometimes called an XXE injection attack is a type of attack that abuses a widely available but rarely used feature of XML parsers. Using XXE, an attacker is able to cause Denial of Service DoS as well as access local and remote content and services. XXE can be...

CVE-2019-10963

CVE-2019-10963 affects Moxa EDR-810 Series routers (all versions 5.1 and prior). An unauthenticated attacker can retrieve log files from the device, potentially disclosing sensitive information due to improper access control. Mitigation per public advisories is upgrading to firmware 5.2 or later ...

Nevma Adaptive Images File Inclusion Vulnerability

WordPress plugin Adaptive Images is used to serve images in Wordpress based on device resolution, allowing dynamic resizing. A file inclusion vulnerability exists in WordPress plugin Adaptive Images versions prior to 0.6.67. An attacker can exploit this vulnerability to retrieve arbitrary files v...

CVE-2019-14205

The CVE-2019-14205 issue affects the WordPress plugin Nevma Adaptive Images prior to 0.6.67, where an LFI could be exploited via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php to read arbitrary server files. Documented by NVD and multiple security ...

CVE-2017-9386

The CVE-2017-9386 entry concerns Vera VeraEdge (1.7.19) and Veralite (1.7.481). A script file get_file.sh on the device allows a user to read files within the cmh-ext folder, but the filename parameter is not properly validated, enabling directory traversal outside /cmh-ext to read arbitrary file...

CVE-2019-12276

A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made...

CVE-2019-10919

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. Attackers with access to port 10005/tcp could perform device reconfigurations and obtain project files from the devices. The system manual recommends to protect access to this port. The security vulnerabili...