PT-2021-6904

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.0.0 through 7.0.1 FortiProxy version 7.0.0 Description A relative path traversal issue may allow an unauthenticated attacker to inject path traversal character sequences, potentially disclosing sensitive server information v...

CVE-2021-37940: Server-Side Request Forgery (SSRF)

An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integration. Using this vulnerability, a malicious Workplace Search admin could use the GHES integration to view hosts that might not be publicly...

Protect

A relative path traversal CWE-23 vulnerabiltiy in FortiOS and FortiProxy may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the GET request of the login page...

CVE-2021-36328: Use of GET Request Method With Sensitive Query Strings

Dell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability. A remote malicious user may potentially exploit this vulnerability to execute SQL commands to perform unauthorized actions and retrieve sensitive information from the database...

The vulnerability of SAP NetWeaver Java Application Server web applications lies in incorrect path name restrictions for access to restricted catalogs, allowing attackers to gain unauthorized access to protected information.

The vulnerability of SAP NetWeaver Java Application Server web applications relates to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to protected information by sending a...

Cross-site Request Forgery (CSRF)

area17/twill is vulnerable to cross-site request forgery. The vulnerability exists due to the use of unsecure GET request which allows an attacker to use the script src="" to log out any user who went to the attacker website...

Millions of Routers, IoT Devices at Risk from BotenaGo Malware

Newly surfaced malware that is difficult to detect and written in Google’s open-source programming language has the potential to exploit millions of routers and IoT devices, researchers have found. Discovered by researchers at AT&T AlienLabs, BotenaGo can exploit more than 30 different...

FrogCMS Path Traversal Vulnerability

FrogCms is an HTTP server. A path traversal vulnerability exists in FrogCMS, which stems from a vulnerability in the FileManagerController.php function in FrogCMS version 0.9.5, which can be exploited to perform a directory traversal attack via the GET request urlencode parameter...

USN-5128-1: Ceph vulnerabilities

Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user credentials in Ceph could be manipulated in certain environments. An attacker could use this to gain unintended access to resources. This issue only affected Ubuntu 18.04 LTS. CVE-2020-27781 It was discovered that Ceph...

CVE-2020-25872

A vulnerability exists within the FileManagerController.php function in FrogCMS 0.9.5 which allows an attacker to perform a directory traversal attack via a GET request urlencode parameter...

Directory traversal

A vulnerability exists within the FileManagerController.php function in FrogCMS 0.9.5 which allows an attacker to perform a directory traversal attack via a GET request urlencode parameter...

CVE-2020-25872

A vulnerability exists within the FileManagerController.php function in FrogCMS 0.9.5 which allows an attacker to perform a directory traversal attack via a GET request urlencode parameter...

CVE-2020-25872

Affected product: FrogCMS 0.9.5. The vulnerability is in FileManagerController.php and allows a directory traversal attack via a GET request urlencode parameter. This is a path traversal issue in the Web UI/file handling code, enabling an attacker to access files outside the intended root. The co...

CVE-2020-25872: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability exists within the FileManagerController.php function in FrogCMS 0.9.5 which allows an attacker to perform a directory traversal attack via a GET request urlencode parameter...

PT-2021-11193

Name of the Vulnerable Software and Affected Versions: FrogCMS version 0.9.5 Description: A vulnerability exists within the FileManagerController.php function in FrogCMS, allowing an attacker to perform a directory traversal attack via a GET request urlencode parameter. Recommendations: For FrogC...

CVE-2020-23042

Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain a cross-site scripting XSS vulnerability in the path parameter of the list and download module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted GET request...

CVE-2020-23041

Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting XSS vulnerability in the path parameter of the list and download exception-handling. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted GET request...

Cross site scripting

Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain a cross-site scripting XSS vulnerability in the path parameter of the list and download module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted GET request...

CVE-2020-23041

Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting XSS vulnerability in the path parameter of the list and download exception-handling. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted GET request...

CVE-2020-23042

Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain a cross-site scripting XSS vulnerability in the path parameter of the list and download module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted GET request...