Lucene search
+L

340 matches found

Cvelist
Cvelist
added 2019/04/20 2:51 p.m.31 views

CVE-2019-11378

An issue was discovered in ProjectSend r1053. upload-process-form.php allows finishedfiles=../ directory traversal. It is possible for users to read arbitrary files and potentially access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code...

8.6AI score0.03645EPSS
SaveExploits1References2
CVE
CVE
added 2019/04/20 2:51 p.m.60 views

CVE-2019-11378

ProjectSend (revision r1053) is affected by CVE-2019-11378 through the upload-process-form.php endpoint, where finished_files[]=../ enables directory traversal. This allows attackers to read arbitrary files and potentially access the supporting database, delete files, leak user passwords, or exec...

8.8CVSS8.6AI score0.03645EPSS
SaveExploits1References2Affected Software1
CNVD
CNVD
added 2018/11/06 12:0 a.m.4 views

Unspecified Vulnerability in ProjectSend

ProjectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. A security vulnerability exists in version r582 of ProjectSend. An attacker could exploit the vulnerability to bypass authentication...

9.8CVSS6.9AI score0.01855EPSS
SaveExploits0References1
CNVD
CNVD
added 2018/11/06 12:0 a.m.4 views

ProjectSend has an unspecified vulnerability (CNVD-2019-36884)

ProjectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. A security vulnerability exists in version r582 of ProjectSend, no details of the vulnerability are provided at this time...

9.8CVSS6.9AI score0.01545EPSS
SaveExploits0References1
NVD
NVD
added 2018/10/29 12:29 p.m.32 views

CVE-2016-10732

ProjectSend formerly cFTP r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?fileid=1, or process-zip-download.php, or adduserform parameters to users-add.php...

9.8CVSS9.6AI score0.01855EPSS
SaveExploits0References1
NVD
NVD
added 2018/10/29 12:29 p.m.19 views

CVE-2016-10734

ProjectSend formerly cFTP r582 allows Insecure Direct Object Reference via includes/actions.log.export.php...

9.8CVSS9.5AI score0.01545EPSS
SaveExploits0References1
NVD
NVD
added 2018/10/29 12:29 p.m.20 views

CVE-2016-10733

ProjectSend formerly cFTP r582 allows directory traversal via file=../ in the process-zip-download.php query string...

9.8CVSS9.5AI score0.02131EPSS
SaveExploits0References1
OSV
OSV
added 2018/10/29 12:29 p.m.6 views

CVE-2016-10734

ProjectSend formerly cFTP r582 allows Insecure Direct Object Reference via includes/actions.log.export.php...

9.8CVSS5.8AI score0.01545EPSS
SaveExploits0References1
OSV
OSV
added 2018/10/29 12:29 p.m.5 views

CVE-2016-10733

ProjectSend formerly cFTP r582 allows directory traversal via file=../ in the process-zip-download.php query string...

9.8CVSS5.8AI score0.02131EPSS
SaveExploits0References1
OSV
OSV
added 2018/10/29 12:29 p.m.7 views

CVE-2016-10732

ProjectSend formerly cFTP r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?fileid=1, or process-zip-download.php, or adduserform parameters to users-add.php...

9.8CVSS5.8AI score0.01855EPSS
SaveExploits0References1
Prion
Prion
added 2018/10/29 12:29 p.m.12 views

Sql injection

ProjectSend formerly cFTP r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selectedclients, clients.php with the request parameter status, process-zip-download.php with the...

7.5CVSS8.3AI score0.01421EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2018/10/29 12:29 p.m.22 views

CVE-2016-10731

ProjectSend formerly cFTP r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selectedclients, clients.php with the request parameter status, process-zip-download.php with the...

9.8CVSS9.9AI score0.01421EPSS
SaveExploits0References1
Prion
Prion
added 2018/10/29 12:29 p.m.18 views

Authentication flaw

ProjectSend formerly cFTP r582 allows Insecure Direct Object Reference via includes/actions.log.export.php...

7.5CVSS7.1AI score0.01545EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2018/10/29 12:29 p.m.16 views

Authentication flaw

ProjectSend formerly cFTP r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?fileid=1, or process-zip-download.php, or adduserform parameters to users-add.php...

7.5CVSS7.3AI score0.01855EPSS
SaveExploits0References1Affected Software1
OSV
OSV
added 2018/10/29 12:29 p.m.6 views

CVE-2016-10731

ProjectSend formerly cFTP r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selectedclients, clients.php with the request parameter status, process-zip-download.php with the...

9.8CVSS5.8AI score0.01421EPSS
SaveExploits0References1
Prion
Prion
added 2018/10/29 12:29 p.m.18 views

Directory traversal

ProjectSend formerly cFTP r582 allows directory traversal via file=../ in the process-zip-download.php query string...

7.5CVSS7.1AI score0.02131EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2018/10/28 3:0 a.m.25 views

CVE-2016-10733

ProjectSend formerly cFTP r582 allows directory traversal via file=../ in the process-zip-download.php query string...

9.5AI score0.02131EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2018/10/28 3:0 a.m.31 views

CVE-2016-10732

ProjectSend formerly cFTP r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?fileid=1, or process-zip-download.php, or adduserform parameters to users-add.php...

9.6AI score0.01855EPSS
SaveExploits0References1
CVE
CVE
added 2018/10/28 3:0 a.m.53 views

CVE-2016-10732

ProjectSend (formerly cFTP) r582 contains an authentication bypass vulnerability that can be exploited via direct requests to users.php, home.php, edit-file.php?file_id=1, process-zip-download.php, or add_user_form_* parameters to users-add.php. The CVE-2016-10732 entry documents impact as authen...

9.8CVSS9.4AI score0.01855EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2018/10/28 3:0 a.m.48 views

CVE-2016-10734

ProjectSend (formerly cFTP) r582 contains an Insecure Direct Object Reference vulnerability in includes/actions.log.export.php. The CNVD entry notes that ProjectSend is a PHP/MySQL self-hosted application, and the NVD entry documents a high-impact issue with access control to object references. T...

9.8CVSS9.3AI score0.01545EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder