PT-2023-7490 · Asustor · Asustor Data Master

Name of the Vulnerable Software and Affected Versions: ASUSTOR Data Master ADM versions 4.0.6.RIS1 and below ASUSTOR Data Master ADM versions 4.1.0 and below ASUSTOR Data Master ADM versions 4.2.2.RI61 and below Description: An Arbitrary File Movement issue was found in ASUSTOR Data Master ADM,...

ASUSTOR Data Master 安全漏洞

ASUSTOR Data Master is a proprietary operating system for ASUSTOR NAS from ASUS in China, featuring a tablet-like graphical interface comparable to a zero-learning curve, making it easy to get started right away. A security vulnerability exists in ASUSTOR Data Master, which stems from the presenc...

ASUSTOR ADM Multiple Vulnerabilities (AS-2023-009, AS-2023-010, AS-2023-011, AS-2023-012)

ASUSTOR ADM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:asustor:adm"; if description...

CVE-2023-34865

CVE-2023-34865 affects ujcms 6.0.2 with a directory traversal flaw that allows moving files via the rename feature. The issue is documented across multiple feeds; endpoints and/or components involved are the ujcms rename path and file moves. Impact is high (CVE/CVSS: Critical) per the primary ent...

CVE-2022-27049

Raidrive before v2021.12.35 allows attackers to arbitrarily move log files by pre-creating a mountpoint and log files before Raidrive is installed...

OpenBoxLab Raidrive 安全漏洞

OpenBoxLab Raidrive is a remote file management system from OpenBoxLab Korea. Allows mapping of WebDAV/FTP/SFTP, routers, Google Drive Team Drive, Photos, OneDrive and Dropbox to network drives on File Explorer. A security vulnerability previously existed in OpenBoxLab Raidrive v2021.12.35, which...

Docker Desktop has an unspecified vulnerability

Docker Desktop is a container-based desktop software for lightweight deployment of applications from Docker, Inc. Docker Desktop has a security vulnerability that could be exploited by attackers to move arbitrary files...

CVE-2022-25365

Docker Desktop before 4.5.1 on Windows allows attackers to move arbitrary files. NOTE: this issue exists because of an incomplete fix for CVE-2022-23774...

PT-2022-17243 · Docker · Docker Desktop +1

Name of the Vulnerable Software and Affected Versions: Docker Desktop versions prior to 4.5.1 Description: The issue allows attackers to move arbitrary files due to an incomplete fix for a previous problem. Recommendations: For versions prior to 4.5.1, update to version 4.5.1 or later to resolve...

Docker Desktop 安全漏洞

Docker Desktop is a container technology-based desktop software for lightweight deployment of applications from the U.S. company Docker. The product provides a desktop environment that supports creating a container lightweight virtual machine and deploying and running applications on...

CVE-2021-21692

FilePathrenameTo and FilePathmoveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission on the source path, instead of 'delete'...

MoveKit - Cobalt Strike Kit For Lateral Movement

Movekit is an extension of built in Cobalt Strike lateral movement by leveraging the executeassembly function with the SharpMove and SharpRDP .NET assemblies. The aggressor script handles payload creation by reading the template files for a specific execution type. IMPORTANT: To use the script a...

Code42 Incydr Series: Bringing Shadow IT into the light with Code42 Incydr

Shadow IT is hardly a hidden threat to security professionals. Gartner was warning, way back in 2016, that 1 in 3 successful attacks experienced by enterprises would come from the use of unsanctioned apps by 2020. Code42’s Data Exposure Report just about proves Gartner’s prediction, showing that...

CVE-2020-9752

CVE-2020-9752 affects Naver Cloud Explorer prior to 2.2.2.11. The vulnerability enables an attacker to move a local file anywhere in the filesystem with system privileges via a named pipe. CVSS information in the provided data shows a high/critical impact (CVSS‑3.1: 9.8, NETWORK, NONE privileges ...

CVE-2018-19042

The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dirfrom and dirto parameters of an mrelocatormove action to the wp-admin/admin-ajax.php URI...

Directory traversal

The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dirfrom and dirto parameters of an mrelocatormove action to the wp-admin/admin-ajax.php URI...

CVE-2018-19042

CVE-2018-19042 affects the WordPress Media File Manager plugin (v1.4.2) via a directory traversal in mrelocator_move that lets an attacker move arbitrary files using dir_from/dir_to parameters to wp-admin/admin-ajax.php. OpenVAS and related entries flag multiple vulnerabilities in

Media File Manager <= 1.4.2 - Authenticated Multiple Vulnerabilities

Following the PoC you can combine the vulnerabilities to obtain PHP code execution and read sensitive file. By default the File Manager can only be used by Administrator users, however, any user role can be configured to use it. Diretory Trasversal: POST /wordpress/wp-admin/admin-ajax.php HTTP/1....

CVE-2018-10521

In CMS Made Simple CMSMS through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory...

CVE-2018-10521

In CMS Made Simple CMSMS through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory...