CVE-2019-19576

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions...

Exploit for Unrestricted Upload of File with Dangerous Type in Verot_Project Verot

class.upload.php...

PHICOMM K2 Remote Code Execution Vulnerability

The PHICOMM K2 is a wireless router from the Chinese company PHICOMM. A remote code execution vulnerability exists in /usr/lib/lua/luci/controller/admin/autoupgrade.lua in PHICOMM K2 version V22.5.9.163, which can be exploited to execute arbitrary commands using shell metacharacters in the...

CVE-2019-19117

/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2PSG1218 V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter...

CVE-2019-19117

/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2PSG1218 V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter...

Command injection

/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2PSG1218 V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter...

CVE-2019-19117

CVE-2019-19117 affects PHICOMM K2 (PSG1218) with V22.5.9.163. The flaw is in /usr/lib/lua/luci/controller/admin/autoupgrade.lua, where remote authenticated users can execute arbitrary commands via shell metacharacters in the cgi-bin/luci autoUpTime parameter. CVSS v3.1 base score 8.8 (HIGH) with ...

CVE-2019-19117

/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2PSG1218 V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter...

Joomla K2 2.9.0 Database Disclosure / SQL Injection

Exploit Title : Joomla K2 Components 2.9.0 SQL Injection / Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/02/2019 Vendor Homepage : getk2.org Software Download Link : getk2.org/downloads/?f=K2v2.9.0.zip Software Information Link :...

Command Execution Vulnerability in Fusion K2 Wireless Router

The Fusion K2 Wireless Router is a wireless router for home use. A command execution vulnerability exists in the Fusion K2 Wireless Router, which stems from a failure to filter the timeRebootEnablestatus and timeRebootrange parameters, and can be exploited by an attacker to execute arbitrary...

Command Execution Vulnerability in K2 Wireless Router of Shanghai Fusion Data Communication Technology Co.

Shanghai Fusion Data Communication Technology Co., Ltd. is a technologically innovative company that provides users with intelligent products and cloud services in the field of smart home. A command execution vulnerability exists in the K2 wireless router of Shanghai Fusion Data Communication...

K2 smartforms server-side request forgery vulnerability

K2 smartforms is the United States K2 company's a browser-based smart form adding tools. A server-side request forgery vulnerability exists in the runtime application in K2 smartforms version 4.6.11. An attacker can exploit this vulnerability by modifying the hostname in the...

CVE-2018-9920

Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an https:///Identity/STS/Forms/Scripts URL...

CVE-2018-9920

Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an https:///Identity/STS/Forms/Scripts URL...

Server side request forgery (ssrf)

Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an https:///Identity/STS/Forms/Scripts URL...

CVE-2018-9920

K2 Smartforms 4.6.11 is affected by a server-side request forgery (SSRF) vulnerability. The issue arises in the runtime application when a modified hostname in the URL https://*/Identity/STS/Forms/Scripts allows an attacker to redirect the application to an external domain, manipulating data rend...

CVE-2018-9920

Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an https:///Identity/STS/Forms/Scripts URL...

K2 Smartforms 4.6.11 Server-Side Request Forgery

Vulnerability type: Server Side Request Forgery Vendor: https://www.k2.com/ Product: K2 Smartforms Affected version: 4.6.11 Credit: Foo Jong Meng CVE ID: CVE-2018-9920 DESCRIPTION: Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an...

Joomla! K2 Component Access Control Error Vulnerability

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds , site search and other features . K2 is used in one of the article system components , the component supports the image display and commenting and other featur...

CVE-2018-7482

The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demonstrated by a view=media&task=connector&cmd=file&target=l1../configuration.php&download=1 request. The specific pathname ../configuration.php should b...