CVE-2015-5463

CVE-2015-5463 affects AxiomSL’s Axiom java applet module (used for editing uploaded Excel files and related Java RMI services) version 9.5.3 and earlier. The connected documents corroborate multiple dangerous impacts: remote attackers can (1) access data of other basic users via arbitrary SQL com...

CVE-2019-1002101

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could r...

Cross site scripting

Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file, inserting an XSS payload into a relevant field e.g., Satellite name, and then restoring the...

Valve: Malformed playlist.txt in GoldSrc games leads to Access Violation & arbitrary code execution

A crafted playlist.txt can be used to exploit a stack overflow vulnerability in GameUI.dll that can lead to arbitrary code execution. Reproduction Place attached playlist.txt in game directory valve, cstrike, etc.. The game will crash when it tries to play Splash track. Exploitability The file ca...

The vulnerability of the scp file copy-to-external utility implementation lies in insufficient validation of input data, allowing a malicious actor to manipulate files in the client’s directory.

The vulnerability of the scp file copy utility implementation is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely from the server, to manipulate files in the client directory...

Jet Database Engine Remote Code Execution Vulnerability

A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to...

CVE-2018-19015

The CVE-2018-19015 issue affects OMRON CX-Supervisor (versions up to 3.42) via project-file parsing. The root cause is improper validation of user-supplied strings, enabling an attacker to inject commands and create/write/read files, potentially executing code with the application’s privileges. D...

CVE-2018-19015

An attacker could inject commands to launch programs and create, write, and read files on CX-Supervisor Versions 3.42 and prior through a specially crafted project file. An attacker could exploit this to execute code under the privileges of the application...

Design/Logic Flaw

app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to inject this code into data\conf\route.php, as demonstrated by a fileputcontents call...

CVE-2017-6921

CVE-2017-6921 affects Drupal 8.x prior to 8.3.4, where the file REST resource does not properly validate certain fields when manipulating files. Exploitation requires the RESTful Web Services (rest) module enabled, the file REST resource enabled and allowing PATCH requests, and an attacker who ca...

CVE-2017-6921 File REST resource does not properly validate

In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services rest module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or...

CVE-2017-6921

In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services rest module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or...

CVE-2017-6921

In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services rest module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or...

Design/Logic Flaw

In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services rest module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or...

Microsoft Windows - MsiAdvertiseProduct Arbitrary File Copy/Read Exploit

Exploit for windows platform in category local exploits The bug is in “MsiAdvertiseProduct” Calling this function will result in a file copy by the installer service. This will copy an arbitrary file that we can control with the first parameter into c:\windows\installer … a check gets done while...

CVE-2018-18332

CVE-2018-18332 affects Trend Micro OfficeScan XG; weak file permissions could let an attacker manipulate key file permissions to modify other files and folders on vulnerable installations. CVSSv3 shows HIGH impact (7.5) with network access and no authentication; no remediation details are provide...

Responsive FileManager 9.13.4 XSS / File Manipulation / Traversal

Responsive FileManager 9.13.4 - Multiple Vulnerabilities Date: December 12, 2018 Author: farisv Vendor Homepage: https://www.responsivefilemanager.com/ Vulnerable Package Link: https://github.com/trippo/ResponsiveFilemanager/releases/download/v9.13.4/responsivefilemanager.zip Responsive FileManag...

Path traversal

A flaw was found in qemu Media Transfer Protocol MTP before version 3.1.0. A path traversal in the in usbmtpwritedata function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest device is mounted in read-write mode, this allows to read/write arbitrary files which may lea...

Novahot - A Webshell Framework For Penetration Testers

novahot is a webshell framework for penetration testers. It implements a JSON-based API that can communicate with trojans written in any language. By default, it ships with trojans written in PHP, ruby, and python. Beyond executing system commands, novahot is able to emulate interactive terminals...

CVE-2018-19044

keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protectedsymlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or...