58 matches found
Stored XSS vulnerability in covcomplplot
covcomplplot 1.1.1 and earlier does not escape the method information in tooltips. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to provide report files to the 'Publish Coverage / Complexity Scatter Plot' post-build step. As of publication of this...
CVE-2020-6012
ZoneAlarm Anti-Ransomware before version 1.0.713 copies files for the report from a directory with low privileges. A sophisticated timed attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems or using symbolic links. This allows an...
DEBIAN-CVE-2020-13882
CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and contro...
LAquis SCADA LGX Report Ini WriteString Arbitrary File Creation Vulnerability
This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
LAquis SCADA LGX Report TextFile Write Arbitrary File Creation Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
LAquis SCADA LGX Report ShellExecute Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
LAquis SCADA LGX Report File BlockWrite Arbitrary File Creation Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
LAquis SCADA LGX Report AddComboFile Arbitrary File Creation Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
LAquis SCADA LGX Report TextFile Append Arbitrary File Creation Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
CVE-2018-16946
LG LNB, LND, LNU, and LNV smart network camera devices have broken access control. Attackers are able to download /updownload/t.report aka Log & Report files and download backup files via download.php without authenticating. These backup files contain user credentials and configuration informatio...
CVE-2018-16234
CVE-2018-16234 affects MorningStar WhatWeb 0.4.9, with a documented XSS vulnerability via JSON report files. The connected documents confirm the issue type but do not provide technical specifics on the exact root cause, vulnerable components, exploitation details, affected versions beyond 0.4.9, ...
PT-2018-13447
Name of the Vulnerable Software and Affected Versions MorningStar WhatWeb version 0.4.9 Description The issue is related to a security problem where MorningStar WhatWeb is affected by XSS via JSON report files. Recommendations For version 0.4.9, at the moment, there is no information about a newe...
CVE-2018-16234: Improper Neutralization of Input During Web Page Generation
MorningStar WhatWeb 0.4.9 has XSS via JSON report files...
PT-2013-5550
Name of the Vulnerable Software and Affected Versions IBM Security AppScan Enterprise versions 5.6 through 8.7.0.1 Description The issue allows remote authenticated users to read arbitrary report files by leveraging knowledge of filenames that cannot be easily predicted. Recommendations For...
CVE-2013-5453: Exposure of Sensitive Information to an Unauthorized Actor
IBM Security AppScan Enterprise 5.6 through 8.7.0.1 allows remote authenticated users to read arbitrary report files by leveraging knowledge of filenames that cannot be easily predicted...
Design/Logic Flaw
Windows Event Log SmartConnector in HP ArcSight Connector Appliance before 6.1 uses world-writable permissions for exported report files, which allows local users to change or delete log data by modifying a file, a different vulnerability than CVE-2011-0770...
