CVE-2019-13205

All configuration parameters of certain Kyocera printers such as the ECOSYS M5526cdw 2R72000.001.701 were accessible by unauthenticated users. This information was only presented in the menus when authenticated, and the pages that loaded this information were also protected. However, all files th...

Vxscan

This is a Python script called Vxscan, which is a comprehensive scanning tool for sensitive file detection, WAF/CDN identification, port scanning, fingerprint/service identification, operating system identification, weak password detection, POC scanning, SQL injection, and other functions. The...

h2: Information Exposure due to insecure handling of permissions in the backup

An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files outside of their permissions via a symlink to a fake database file...

Selesta Visual Access Manager Information Disclosure Vulnerability

Selesta Visual Access Manager VAM is the Selesta Visual Access Manager. A security vulnerability exists in Selesta Visual Access Manager VAM versions 4.15.0 through 4.29, which stems from the /common/vameditXml.php page not checking the parameter used to specify the name of the file to read. An...

CVE-2019-6193

CVE-2019-6193 affects Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6. It is an information-disclosure vulnerability that could allow unauthenticated access to configuration files containing usernames, license keys, IP addresses, and encrypted password hashes. Lenovo advisories recom...

Magento path traversal vulnerability (CNVD-2020-04824)

Magento is an open source e-commerce framework. Magento has a path traversal vulnerability that can be exploited by remote attackers to submit a special request that can obtain sensitive file information...

CVE-2020-8009

CVE-2020-8009 affects AVB MOTU devices; the vulnerability is a /.. directory traversal that enables reading files such as /etc/passwd. The available documents consistently describe the flaw and its impact, but they do not provide exploitation details or explicit remediations. No additional techni...

Solaris xlock Information Disclosure

@Mediaservice.net Security Advisory 2020-01 last updated on 2020-01-15 Title: Low impact information disclosure via Solaris xlock Application: Setuid root xlock binary distributed with Solaris Platforms: Oracle Solaris 11.x confirmed on 11.4 X86 Oracle Solaris 10 confirmed on 10 1/13 X86...

Vxscan

This is a Python script called Vxscan, which is a comprehensive scanning tool. It is written in Python 3.6 or later and is designed to perform various scanning tasks, including sensitive file detection, WAF/CDN identification, port scanning, fingerprint/service identification, operating system...

CVE-2019-18287

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. The Application Server exposes directory listings and files containing sensitive information. This vulnerability is independent from CVE-2019-18286. Please note that an attacker needs to have...

CVE-2019-18286

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. The Application Server exposes directory listings and files containing sensitive information. This vulnerability is independent from CVE-2019-18287. Please note that an attacker needs to have...

Bullwark Momentum Series JAWS 1.0 - Directory Traversal Vulnerability

Exploit for php platform in category web applications Title: Bullwark Momentum Series JAWS 1.0 - Directory Traversal Author: Numan Türle Vendor Homepage: http://www.bullwark.net/ Version : Bullwark Momentum Series Web Server JAWS/1.0 Software Link :...

Siemens SPPA-T3000 Application Server Improper Authentication Vulnerability (CNVD-2019-45414)

SPPA-T3000 is a distributed control system mainly used in thermal power plants and large-scale renewable energy power plants.Application Server is the application server in it, which provides the main system services including access control, distribution of data to thin clients and archiving. A...

CVE-2019-15996 Cisco DNA Spaces: Connector Privilege Escalation Vulnerability

A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient restrictions during the execution of an affected CLI command. An...

U.S. Dept Of Defense: Unprotected ██████ and Test site API Exposes Documents, Credentials, and Emails in ██████████ Proposal System

Summary: The test/integration API of the █████ web services is publicly exposed: disclosing documents, emails, and credentials to what appears to be the Seaport Bid proposal system. Because I did not attempt any exploitation outside of that necessary to deem this a reportable issue, it is not cle...

CVE-2019-3663

Unprotected Storage of Credentials vulnerability in McAfee Advanced Threat Defense ATD prior to 4.8 allows local attacker to gain access to the root password via accessing sensitive files on the system. This was originally published with a CVSS rating of High, further investigation has resulted i...

CVE-2019-3663

Unprotected Storage of Credentials vulnerability in McAfee Advanced Threat Defense ATD prior to 4.8 allows local attacker to gain access to the root password via accessing sensitive files on the system. This was originally published with a CVSS rating of High, further investigation has resulted i...

Design/Logic Flaw

Unprotected Storage of Credentials vulnerability in McAfee Advanced Threat Defense ATD prior to 4.8 allows local attacker to gain access to the root password via accessing sensitive files on the system. This was originally published with a CVSS rating of High, further investigation has resulted i...

CVE-2019-3663

The CVE-2019-3663 issue affects McAfee Advanced Threat Defense (ATD) prior to version 4.8. It arises from unprotected storage of credentials, enabling a local attacker to read the root password from sensitive files; the root password is common across ATD deployments prior to 4.8. CVSS assessments...

PT-2019-15560 · Helm +2 · Helm +2

Name of the Vulnerable Software and Affected Versions: Helm versions 2.x through 2.15.1 Description: The issue allows a maliciously designed chart to include sensitive content, such as /etc/passwd, or to execute a denial of service DoS via a special file, like /dev/urandom, using symlinks. This i...