CVE-2020-28374

In drivers/target/targetcorexcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a...

Marvell QConvergeConsole GUI Authorization Issues Vulnerability

Marvell QConvergeConsole QCC is a unified adapter management software across data centers from Marvell. The software is primarily used for Ethernet and Fibre Channel adapter management, among other things. A security vulnerability exists in the Marvell QConvergeConsole GUI version 5.5.0.74 and...

MiniCMS Directory Traversal Vulnerability

MiniCMS is a micro content management system designed for personal websites. A directory traversal vulnerability exists in post-edit.php in MiniCMS V1.10. A remote attacker can exploit this vulnerability to include and execute arbitrary files via the state parameter...

CVE-2020-36052

Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter...

Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software

CISCO CVE-2020-3452 Scanner & Exploiter It will scan the targ...

CVE-2020-17518 Apache Flink directory traversal attack: remote file writing through the REST API

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or...

Cassandra Web 0.5.0 - Remote File Read

Exploit Title: Cassandra Web 0.5.0 - Remote File Read Date: 12-28-2020 Exploit Author: Jeremy Brown Vendor Homepage: https://github.com/avalanche123/cassandra-web Software Link: https://rubygems.org/gems/cassandra-web/versions/0.5.0 Version: 0.5.0 Tested on: Linux !/usr/bin/python -- coding: UTF-...

MTN Group: 2x Remote file inclusion within your VMware Instances

Summary: 2x Remote file inclusion within your VMware Instances Hosts: nmc.vc.mtn.co.ug h28a.n1.ips.mtn.co.ug Steps To Reproduce: Navigate to the URLs given below, /etc/passwd will be displayed. https://nmc.vc.mtn.co.ug/eam/vib?id=/etc/passwd https://h28a.n1.ips.mtn.co.ug/eam/vib?id=/etc/passwd...

Cassandra Web 0.5.0 Remote File Read

!/usr/bin/python -- coding: UTF-8 -- cassmoney.py Cassandra Web 0.5.0 Remote File Read Exploit Jeremy Brown jbrown3264/gmail Dec 2020 Cassandra Web is vulnerable to directory traversal due to the disabled Rack::Protection module. Apache Cassandra credentials are passed via the CLI in order for th...

CVE-2020-35362

DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. This could allow remote files to be downloaded via a dext5CMD=downloadRequest action with traversal in the fileVirtualPath parameter the attacker must provide the correct fileOrgName value...

CVE-2020-35362

DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. This could allow remote files to be downloaded via a dext5CMD=downloadRequest action with traversal in the fileVirtualPath parameter the attacker must provide the correct fileOrgName value...

CVE-2020-35362

CVE-2020-35362 affects DEXT5Upload 2.7.1262310 and earlier. The issue is Directory Traversal in handler/dext5handler.jsp, allowing remote files to be downloaded via a dext5CMD=downloadRequest action when traversal is used in the fileVirtualPath parameter and the attacker provides the correct file...

PT-2020-17315

Name of the Vulnerable Software and Affected Versions DEXT5Upload versions 2.7.1262310 and earlier Description The issue allows remote files to be downloaded via a "dext5CMD=downloadRequest" action with traversal in the fileVirtualPath parameter, provided the attacker has the correct fileOrgName...

Network Management System REST API File Re-record

The vulnerability of the REST API interface of the Cisco Data Center Network Manager DCNM system is related to errors in processing input data. Exploiting this vulnerability allows an attacker to re-record any files on the device remotely...

curl: Incorrect argument check can allow remote servers to overwrite local files

A flaw was found in curl. Overwriting local files is possible when using a certain combination of command line options. Requesting content from a malicious server could lead to overwriting local files with compromised files leading to unknown effects. The highest threat from this vulnerability is...

PT-2020-6135

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.15 Description The issue allows a remote attacker to delete arbitrary files on the host as long as the executing process has sufficient rights, by manipulating the processed input stream. This can be done when...

FileZen vulnerable to directory traversal

Overview FileZen provided by Soliton Systems K.K. is an appliance for secure file transfer and sharing by mail or an web interface. FileZen contains a directory traversal vulnerability CWE-22. Soliton Systems K.K. reported this vulnerability to IPA to notify users of its solution through JVN...

NewStart CGSL CORE 5.04 / MAIN 5.04 : lftp Vulnerability (NS-SA-2020-0068)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has lftp packages installed that are affected by a vulnerability: - It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local...

Foxit Reader Resource Management Vulnerability

Foxit Reader is a PDF document reader. A type confusion vulnerability exists in Foxit Reader, which can be exploited by a remote attacker to submit a special file request and trick the user into parsing it, which can crash the application or execute arbitrary code in the application context...

Foxit Reader Resource Management Vulnerability

Foxit Reader is a PDF document reader. A memory misreference vulnerability exists in Foxit Reader, which allows remote attackers to submit a special file request that can be exploited to trick the user into parsing it, which can crash the application or execute arbitrary code in the application...