6456 matches found
The vulnerability of the ColdFusion software platform, related to errors in restricting the path name of the restricted directory, allows a perpetrator to write any files into the device’s file system.
The vulnerability of the ColdFusion software platform is related to errors in restricting the path name of the restricted directory. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the device’s file system remotely...
CVE-2019-0381
A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, can result in the inadvertent access of files located in directories outside of the paths specified by the user...
Vulnerabilities of the OPC server Exaopc, the statistical information processing software package Exaplog, the production data management system Exaquantum, the data analysis software Exaquantum/Batch, the set of software packages for multi-parameter optimization and management Exasmoc, the quality assessment software Exarqe, the data storage software with additional features GA10, the performance reporting software InsightSuiteAE. The vulnerability exists because the path to the executable file of the service is not enclosed in quotes and contains spaces, allowing attackers to exploit their privileges and execute arbitrary code.
The vulnerabilities of the OPC server Exaopc, the statistical information processing software package Exaplog, the production data management system Exaquantum, the data analysis software Exaquantum/Batch, the multi-parameter optimization and management software suite Exasmoc, the quality...
Flare-Emu - Powered by IDA Pro and the Unicorn emulation framework that provides scriptable emulation features for the x86, x86_64, ARM, and ARM64 architectures to reverse engineers
flare-emu marries IDA Pro’s binary analysis capabilities with Unicorn’s emulation framework to provide the user with an easy to use and flexible interface for scripting emulation tasks. It is designed to handle all the housekeeping of setting up a flexible and robust emulator for its supported...
WP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site Scripting
Exploit Title: WP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site Scripting Date: 2019-09-10 Exploit Author: strider Software Link: https://github.com/anttiviljami/wp-server-log-viewer Version: 1.0 Tested on: Debian 10 Buster x64 / Kali Linux CVE : None...
dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass
A flaw was found in dbus. The implementation of DBUSCOOKIESHA1 is susceptible to a symbolic link attack. A malicious client with write access to its own home directory could manipulate a /.dbus-keyrings symlink to cause the DBusServer to read and write in unintended locations resulting in an...
Kernel: page cache side channel attacks
A new software page cache side channel attack scenario was discovered in operating systems that implement the very common 'page cache' caching mechanism. A malicious user/process could use 'in memory' page-cache knowledge to infer access timings to shared memory and gain knowledge which can be us...
Path Traversal
Overview All versions of @wturyn/swagger-injector are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured dist folder using relative paths. Recommendation No fix is currently available. Consider using an alternative...
Path Traversal
Overview All versions of swagger-injector are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured dist folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package...
Information Disclosure
librenms is vulnerable to information disclosure. The attack exists because it does not prevent the user from fingerprinting the exact code installed to get local file paths...
LibreNMS Information Disclosure Vulnerability
LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool . An information disclosure vulnerability exists in LibreNMS 1.47 and earlier versions, which can be exploited by an attacker to identify the exact code version installed and obtain local file paths...
CVE-2019-10667
An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths...
CVE-2019-10667
An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths...
Information disclosure
An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths...
CVE-2019-10667
An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths...
Definitive Dossier of Devilish Debug Details – Part One: PDB Paths and Malware
Have you ever wondered what goes through the mind of a malware author? How they build their tools? How they organize their development projects? What kind of computers and software they use? We took a stab and answering some of those questions by exploring malware debug information. We find that...
CVE-2017-18586
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...
CVE-2017-18586
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...
Directory traversal
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...
CVE-2019-5634
An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy BLE from the mobile application are logged in...