ABB HMI Hardcoded Credentials File Read Vulnerability

ABB PB610 is a software from ABB Switzerland for designing graphical user interfaces for the CP600 control panel platform. A file read vulnerability exists in ABB HMI Hardcoded Credentials, which can be exploited by an attacker to read or write to the HMI configuration file and reset the device...

PHPSHE Mall System has XML External Entity Injection Vulnerability

PHPSHE mall system is a combination of product display, online shopping, order management, payment management, article management, customer consultation feedback and other functions, providing users with online shopping mall construction program. PHPSHE mall system exists XML external entity...

Debian DSA-4415-1 : passenger - security update

An arbitrary file read vulnerability was discovered in passenger, a web application server. A local user allowed to deploy an application to passenger, can take advantage of this flaw by creating a symlink from the REVISION file to an arbitrary file on the system and have its content displayed...

OPENSUSE-SU-2019:0194-1 Security update for phpMyAdmin

This update for phpMyAdmin to version 4.8.5 fixes the following issues: Security issues fixed: - CVE-2019-6799: Fixed an arbitrary file read vulnerability boo1123272 - CVE-2019-6798: Fixed a SQL injection in the designer interface boo1123271 Other changes: Fix rxport to SQL format not available F...

CVE-2019-8389

A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. By default, the application runs a transfer service on port 8080, accessible by everyone on the same Wi-Fi network. An attacker can send the POST parameters downfiles and cur-folder with a crafted ../ payload...

CVE-2019-8389

The CVE-2019-8389 issue affects Musicloud 1.6, where the Wi‑Fi transfer feature runs a service on port 8080 accessible to any device on the same network. Affected component is the download.script endpoint, which processes POST parameters downfiles and cur-folder. A crafted ../ payload enables an ...

Fedora 29 : phpMyAdmin (2019-09ae31d880)

Upstream announcement: Security fix: phpMyAdmin 4.8.5 is released The phpMyAdmin team announces the release of phpMyAdmin version 4.8.5. Among other bug fixes, this contains several important security fixes. Upgrading is highly recommended for all users. The security fixes involve : - Arbitrary...

Fedora 28 : phpMyAdmin (2019-6cfd17b03d)

Upstream announcement: Security fix: phpMyAdmin 4.8.5 is released The phpMyAdmin team announces the release of phpMyAdmin version 4.8.5. Among other bug fixes, this contains several important security fixes. Upgrading is highly recommended for all users. The security fixes involve : - Arbitrary...

Arbitrary File Deletion, File Read Vulnerability in Ectouch WechatController Backend

ECTouch is a mobile mall online store system launched by Shanghai Shangchuang Network Technology Co. Ectouch WechatController backend exists arbitrary file deletion, file reading vulnerability. Attackers can use the vulnerability to reinstall the system and obtain configuration files...

S-CMS File Read Vulnerability

S-CMS is a content management system CMS based on PHP and MySQL. A file read vulnerability exists in the admin/download.php file in S-CMS version 1.0, which can be exploited by an attacker to read files with the help of the 'DownName' parameter...

CVE-2018-20463

The JSmol2WP plugin for WordPress (version 1.07 and earlier) is vulnerable to Local File Inclusion (LFI) and Server-Side Request Forgery (SSRF) . The root cause is a directory traversal vulnerability occurring via ../ sequences in the query=php://filter/resource= parameter of the jsmol.php query ...

Microsoft Windows - MsiAdvertiseProduct Arbitrary File Read Exploit

Exploit for windows platform in category local exploits The bug is in “MsiAdvertiseProduct” Calling this function will result in a file copy by the installer service. This will copy an arbitrary file that we can control with the first parameter into c:\windows\installer … a check gets done while...

CVE-2018-19039

Grafana CVE-2018-19039 affects Grafana before 4.6.5 and 5.x before 5.3.3, allowing remote authenticated users with Editor or Admin perms to read arbitrary files. Root cause is a file-read exposure via dashboards/editors. Upgrading to Grafana 4.6.5 or 5.3.3+ mitigates the issue; check vendor advis...

CVE-2018-19748

app/plug/attachment/controller/admincontroller.php in SDCMS 1.6 allows reading arbitrary files via a /?m=plug&c=admin&a=index&p=attachment&root= directory traversal. The value of the root parameter must be base64 encoded note that base64 encoding, instead of URL encoding, is very rare in a...

Huawei Cloud RDS service suffers from arbitrary file read vulnerability

Huawei Cloud RDS Service is a specialized high-performance and highly reliable cloud database service provided by Huawei Technologies Co. An arbitrary file read vulnerability exists in Huawei Cloud RDS Service, which can be exploited by an attacker to read arbitrary files...

Design/Logic Flaw

An issue was discovered in BageCMS 3.1.3. The attacker can execute arbitrary PHP code on the web server and can read any file on the web server via an index.php?r=admini/template/updateTpl&filename= URI...

CVE-2018-15697

ASUSTOR Data Master (ADM) prior to version 3.1.6 is affected by CVE-2018-15697. Authenticated non-administrative users can read any file on a shared NAS by supplying the full path in the request (example: /home/admin/.ash_history). The issue stems from a file-disclosure vulnerability in ADM 3.1.5...

Jenkins < 2.133 and < 2.121.2 LTS Multiple Vulnerabilities - Windows

Jenkins is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-3766

The CVE-2018-3766 issue affects the buttle module for Node.js, where versions

OneFileCMS Information Disclosure Vulnerability

OneFileCMS is a lightweight CMS system. The system runs on PHP and JavaScript and includes features such as document editing, file uploading and file management. A security vulnerability exists in the onefilecms.php file in OneFileCMS 2017-10-08 and earlier versions. An attacker can exploit the...