30276 matches found
EulerOS 2.0 SP5 : lftp (EulerOS-SA-2019-2165)
According to the version of the lftp package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the...
File Inclusion Vulnerability in MetInfo V7.0.0beta Backend
MetInfo is an open source and free CMS building system suitable for enterprise building, MetInfo enterprise website management system is mainly used to build enterprise websites, using PHP + Mysql architecture. MetInfo V7.0.0beta backend file containment vulnerability can be exploited by an...
CVE-2019-17326
ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET request with a specially crafted parameter. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page...
CVE-2019-17325
ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX method in RexViewerCtrl30.ocx. That could lead to disclosure of sensitive information. User interaction is required to exploit this vulnerability in that the target must visit a...
CVE-2019-12415
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity XXE Processing...
Cisco Unified Intelligence Center Remote File Injection Vulnerability
A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a user's browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget...
The vulnerability of the ColdFusion software platform, related to errors in restricting the path name of the restricted directory, allows a perpetrator to write any files into the device’s file system.
The vulnerability of the ColdFusion software platform is related to errors in restricting the path name of the restricted directory. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the device’s file system remotely...
CVE-2019-15862
An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension even if the application was configured to accept files only with a defined set of extensions. This affects CKFinder for ASP, CKFinder for ASP.NET,...
CVE-2015-9415
The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion...
Remote file inclusion
The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion...
EUVD-2015-9255
The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion...
CVE-2015-9415
Vulnerability context: The BJ Lazy Load plugin for WordPress (versions before 1.0) has a Remote File Inclusion (RFI) vulnerability via TimThumb. The connected nuclei template explicitly notes RFI through TimThumb in BJ Lazy Load
CVE-2015-9415
The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion...
WordPress bj-lazy-load plugin remote file inclusion vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. bj-lazy-load is a page content delayed loading plugin used in it. A remote file inclusion vulnerability exists in versions of the...
CVE-2019-13063
Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Scriptview page. This will result in file disclosure i.e., being able to pull any file from the remote victim application. This can be used to steal and...
CVE-2019-13063
Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Scriptview page. This will result in file disclosure i.e., being able to pull any file from the remote victim application. This can be used to steal and...
The vulnerability of the _unzip_iter() function in the natural language processing and statistical processing library NLTK allows a hacker to write arbitrary files.
The vulnerability of the unzipiter function in the natural language processing and statistical processing library NLTK is related to an incorrect limitation on the path name for the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to write arbitrary files...
Supra Smart Cloud TV Remote File Inclusion
Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication via a /remote/mediacontrol?action=setUri&uri= URI. Recent assessments: pbarry-r7 at November 20, 2019 11:40pm UTC reported: Have to be on...
XXE Injection Vulnerability in UsualToolCMS Frontend
UsualToolCMS UTCMS is an enterprise web content management system CMS based on PHP and MySQL. An XXE injection vulnerability exists in the frontend of UsualToolCMS. An attacker can exploit the vulnerability to remotely read arbitrary files on the server...