4820 matches found
CVE-2018-6910
DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/incarchivesfunctions.php...
CVE-2018-6910: Exposure of Resource to Wrong Sphere
DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/incarchivesfunctions.php...
PT-2018-17818
Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 Description The issue allows remote attackers to discover the full path of the system via a direct request for certain files, such as "include/downmix.inc.php" or "inc/inc archives functions.php". Recommendations For DedeCM...
CVE-2018-6880
EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php...
CVE-2018-6881
EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php...
CVE-2018-6880
EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php...
CVE-2018-6881
EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php...
CVE-2018-6880
EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php...
CVE-2018-6880
EmpireCMS versions 6.6–7.2 are affected by a vulnerability in class/connect.php where an array value in a parameter enables remote attackers to discover the full server path. impact: path disclosure; no exploitation details or patches are provided in the connected documents. Remediation status/no...
CVE-2018-6881
CVE-2018-6881 affects EmpireCMS 6.6. The vulnerability allows remote attackers to discover the full filesystem path via an array value passed to admin/tool/ShowPic.php, indicating a path leakage weakness in ShowPic.php. Root cause: improper handling of a request parameter leading to information d...
PT-2018-17800
Name of the Vulnerable Software and Affected Versions EmpireCMS versions 6.6 through 7.2 Description The issue allows remote attackers to discover the full path via an array value for a parameter to "class/connect.php". Recommendations For EmpireCMS versions 6.6 through 7.2, update to a version...
CVE-2018-6881: Exposure of Sensitive Information to an Unauthorized Actor
EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php...
PT-2018-17801
Name of the Vulnerable Software and Affected Versions EmpireCMS version 6.6 Description The issue allows remote attackers to discover the full path via an array value for a parameter to "admin/tool/ShowPic.php" API endpoint. Recommendations For EmpireCMS version 6.6, consider restricting access t...
CVE-2018-1000023
Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request...
Input validation
Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request...
CVE-2018-1000023
Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request...
CVE-2018-1000023
Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request...
PT-2018-9214
Name of the Vulnerable Software and Affected Versions: Insight-api versions 5.0.0 and earlier Description: The issue concerns a lack of input validation in the transaction broadcast endpoint, which can lead to Full Path Disclosure. This can be exploited via a web request. Recommendations: For...
CVE-2018-1000023: Improper Input Validation
Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request...