6008 matches found
Server side template injection in Apache Camel
Server-Side Template Injection and arbitrary file disclosure on Camel templating components...
CVE-2020-14490
OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files, which may allow disclosure of sensitive files or the execution of malicious uploaded files...
CVE-2020-14490
OpenClinic GA versions 5.09.02 and 5.89.05b contain a path traversal vulnerability (CWE-22) that allows arbitrary local files to be specified via parameters and may execute uploaded files, risking disclosure of sensitive data and code execution. The issue corresponds to CVE-2020-14490; root cause...
PT-2020-14183 · Typo3 · Typo3/Cms
Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 9.0.0 through 9.5.19 TYPO3 CMS versions 10.0.0 through 10.4.5 Description: In a case where an attacker manages to generate a valid cryptographic message authentication code HMAC-SHA1 - either by using a different existing...
FLIR AX8 Thermal Camera Arbitrary File Disclosure
An information disclosure vulnerability exists in FLIR. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information...
CVE-2020-15419
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.75020200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ReporterImportLicense class. Due to the improper restriction of...
PT-2020-6128 · Php +2 · Php +2
Name of the Vulnerable Software and Affected Versions: Chadha PHPKB version 9.0 Enterprise Edition Description: The issue is related to insufficient input validation in the Chadha PHPKB software. This allows a remote unauthenticated attacker to disclose local files on hosts running PHP versions...
WordPress Email Subscribers And Newsletters 4.2.2 File Disclosure
Exploit Title: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download Google Dork: "Stable tag" inurl:wp-content/plugins/email-subscribers/readme.txt Date: 2020-07-20 Exploit Author: KBA@SOGETIESEC Vendor Homepage: https://www.icegram.com/email-subscribers/ Softwar...
CVE-2020-15124
In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. This is limited to files accessible to the application server user, eg. tomcat, but can potentially lead to the disclosure of sensitive...
SAP NetWeaver Directory Traversal (CVE-2020-6286; CVE-2020-6287)
A directory traversal vulnerability exists in SAP NetWeaver. Successful exploitation of this vulnerability could lead to disclosure of file contents accessible by the prime user...
Acronis: Local File Disclosure /Delete On [us-az-vpn.acronis.com]
Cisco ASA VPN server hosted on https://us-az-vpn.acronis.com was found to be using an outdated version that suffers from a Local File Disclosure /Delete vulnerability. Through this vulnerability an unauthenticated remote attacker can read and delete the contents of any file stored on the VPN serv...
CVE-2020-11994
A flaw was found in camel. Camel's templating components are suseptable to Server-Side Template Injection and arbitrary file disclosure. The highest threat from this vulnerability is to data confidentiality...
CVE-2020-11994
Server-Side Template Injection and arbitrary file disclosure on Camel templating components...
CVE-2020-11994
Server-Side Template Injection and arbitrary file disclosure on Camel templating components...
Design/Logic Flaw
Server-Side Template Injection and arbitrary file disclosure on Camel templating components...
CVE-2020-11994
Server-Side Template Injection and arbitrary file disclosure on Camel templating components...
CVE-2020-11994
CVE-2020-11994 is a Server-Side Template Injection in the Apache Camel templating component used by Oracle Enterprise Manager Cloud Control Base Platform (13.4.0.0), specifically in the Reporting Framework. The vulnerability enables arbitrary file disclosure and high-impact data exposure due to C...
F5 BIG-IP Traffic Management User Interface File Disclosure
File disclosure vulnerability in F5 BIG-IP Traffic Management User Interface Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...
Rockwell Automation FactoryTalk Services Platform XML External Entity Injection Vulnerability
Rockwell Automation FactoryTalk Services Platform is a suite of services platforms from Rockwell Automation that provides routine services for applications such as diagnostic information, health monitoring and real-time data access. An XML external entity injection vulnerability exists in Rockwel...