Trend Micro Worry-Free Business Security 路径遍历漏洞

Trend Micro Worry-Free Business Security is a suite of enterprise-class information security protection solutions from Trend Micro. The product provides anti-spam, anti-virus, network security and e-mail protection. A path traversal arbitrary remote file deletion vulnerability exists in Trend Mic...

The vulnerability of the REST API implementation of the Cisco Edge Fog Fabric data processing platform allows a attacker to re-write any files in the operating system of the vulnerable device.

The vulnerability of the REST API implementation of the Cisco Edge Fog Fabric data processing platform involves exposing resources to an unauthorized area. Exploiting this vulnerability could allow a malicious actor to rewrite any files in the operating system of the vulnerable device remotely...

Remote file inclusion

An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file...

CVE-2020-28688

CVE-2020-28688 affects ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0. The vulnerability is in the add artwork functionality, which allows remote attackers to upload arbitrary files, potentially enabling remote code execution. The Exploit-DB PoC demonstrates an authenticated workflow to ...

Code Projects Artworks Gallery Code Issues Vulnerabilities

Code Projects Artworks Gallery is an online artwork management website builder organized by Code Projects. A security vulnerability in ARTWORKS GALLERY, which exists within the Edit Configuration File feature in PHP, CSS, JAVASCRIPT, and MYSQL 1.0, can be exploited by remote attackers to upload...

SIGE 3.4.1 / 3.5.3 Pro Cross Site Scripting / Remote File Inclusion

Document Title: =============== SIGE Joomla 3.4.1 & 3.5.3 Pro - Multiple Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2265 Release Date: ============= 2020-11-11 Vulnerability Laboratory ID VL-ID: ====================================...

vulhub

It is an offensive tool for vulnerable environments. The repository contains a collection of pre-built vulnerable docker environments, including Flask SSTI, Apache Parsing Vulnerability, and others. The tool allows users to easily create and run vulnerable environments for testing and training...

Joomla SIGE 3.4.1-FREE / 3.5.3-PRO RFI / Cross Site Scripting

Title: SIGE - Simple Image Gallery Extended joomla extension 3.4.1-FREE / 3.5.3-PRO - Multi Vulnerability Remote File Inclusion RFI & Cross Site Scripting XSS date: 2020-11-11 Vendor Homepage: https://kubik-rubik.de/ Software Link: https://kubik-rubik.de/sige-simple-image-gallery-extended Softwar...

BugPoC: XSS PoC for the wacky.buggywebsite.com challenge

Summary: https://wacky.buggywebsite.com/frame.html is vulnerable to DOM-based XSS. Steps To Reproduce: 1. Navigate to https://oembed.dev.ipwnedyour.net/wacky.buggywebsite.com.xss.html 1. Verify the document's origin is displayed in an alert box. PoC code details: The PoC page at...

BugPoC: [BugPOC and Amazon XSS CTF writeup] A CSP Bypass Story

Summary/Description: There were quite multiple restrictions imposed while executing JavaScript on the website. I have divided them into three segments which are explained below Bypassing the iframe loading restriction The URL https://wacky.buggywebsite.com/frame.html?param=Hello,%20World when...

PT-2020-6901 · Apache +2 · Apache Shiro +2

Name of the Vulnerable Software and Affected Versions: Apache Shiro versions prior to 1.7.0 Description: The issue is related to an authentication bypass when Apache Shiro is used with Spring. A specially crafted HTTP request may cause this bypass, potentially allowing a remote attacker to exploi...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2020-2456)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability

CVE-2020-1938 is a file read/inclusion vulnerability in the AJP connector in Apache Tomcat. This is enabled by default with a default configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instance...

File Upload Vulnerability in Laiku Push Mall System (CNVD-2020-62378)

Laikepush mall system is a system with independent copyright, is an integrated e-commerce system all the functions of the platform. A file upload vulnerability exists in the Laikipu Mall System, which can be exploited by attackers to upload remote files to the server and realize getshell...

SAP BusinessObjects Business Intelligence Platform Cross-Site Request Forgery Vulnerability

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. The product has report generation, analysis, data visualization and other functions. A cross-site request forgery vulnerability exists in SAP...

CVE-2020-9782

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. A remote attacker may be able to overwrite existing files...

CVE-2020-9782

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. A remote attacker may be able to overwrite existing files...

Zhongbang CRMEB server-side request forgery vulnerability

Zhongbang CRMEB is an open source e-commerce management system from Zhongbang Networks Zhongbang in Xi'an, China. CRMEB version 3.0 has a server-side request forgery vulnerability , the vulnerability stems from the downloadimage interface SSRF vulnerability , you can remotely download any file on...

CVE-2020-25466

A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code...

Server side request forgery (ssrf)

A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code...