CVE-2019-16986

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. resources\securedownload.php is also affected...

CVE-2019-8071

Adobe Download Manager versions 2.0.0.363 have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation...

Privilege escalation

Adobe Download Manager versions 2.0.0.363 have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation...

Adobe Download Manager Insecure File Permissions Vulnerability

Adobe Download Manager is an application for managing and downloading Adobe products from Adobe USA. A security vulnerability exists in version 2.0.0.363 of Adobe Download Manager for Windows-based platforms. An attacker can exploit the vulnerability to elevate privileges...

Adobe Download Manager CVE-2019-8071 Insecure File Permission Vulnerability

Description Adobe Download Manager is prone to an insecure file-permission vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions with elevated privileges; this may aid in launching further attacks. Adobe Download Manager 2.0.0.3...

CVE-2019-0073 Junos OS: PKI key pairs are exported with insecure file permissions

The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user on the Junos OS device with shell access to read them. This issue affects: Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D18...

CVE-2019-0073

CVE-2019-0073 describes a local vulnerability in Juniper Networks Junos OS where PKI keys exported via the command run request security pki key-pair export may have insecure file permissions. This could allow a local user with shell access to read those keys. Affected releases include Junos OS 15...

Juniper Junos CVE-2019-0073 Local Insecure File Permissions Vulnerability

Description Juniper Junos is prone to a local insecure file-permission vulnerability. A local attacker can exploit this issue to access sensitive information stored in the file-system. The following versions of Junos are vulnerable. Juniper Junos 15.1X49 versions prior to 15.1X49-D180 Juniper Jun...

CVE-2019-17352

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions...

Design/Logic Flaw

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions...

Local File Inclusion

librenms/librenms is vulnerable to local file inclusion. The usage of mysqlrealescapestring in pdf.php to sanitize file paths is insecure. Due to the usage of include that takes in untrusted user-supplied data to include scripts, a remote attacker could potentially include arbitrary scripts to be...

CVE-2018-18630

A vulnerability was found in McKesson Cardiology product 13.x and 14.x. Insecure file permissions in the default installation may allow an attacker with local system access to execute unauthorized arbitrary code...

Code injection

A vulnerability was found in McKesson Cardiology product 13.x and 14.x. Insecure file permissions in the default installation may allow an attacker with local system access to execute unauthorized arbitrary code...

CVE-2018-20945

bin/csvprocess in cPanel before 68.0.27 allows insecure file operations SEC-354...

CVE-2018-20945

bin/csvprocess in cPanel before 68.0.27 allows insecure file operations SEC-354...

CVE-2018-20945

The CVE-2018-20945 issue affects cPanel prior to 68.0.27 (bin/csvprocess) and enables insecure file operations due to SEC-354. Affected product: cPanel / web hosting control panel. Root cause details are consistently described across connected records as insecure file handling in bin/csvprocess b...

CVE-2018-20945

bin/csvprocess in cPanel before 68.0.27 allows insecure file operations SEC-354...

Design/Logic Flaw

The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account SEC-477...

CVE-2019-10267

An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the...

Design/Logic Flaw

An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the...