942 matches found
CVE-2020-20444
Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/viewsource.php' which "could" lead to RCE vulnerability...
Security feature bypass
Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/viewsource.php' which "could" lead to RCE vulnerability...
CVE-2020-20444
Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/viewsource.php' which "could" lead to RCE vulnerability...
CVE-2021-27657
Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls...
Dreamer CMS suffers from a directory traversal vulnerability
Dreamer CMS dreamer content publishing system is the first java development content publishing system , using the most popular springboot + thymeleaf framework to build , flexible and compact , simple configuration . Dreamer CMS has a directory traversal vulnerability that can be exploited by an...
Cassia Networks Access Controller 路径遍历漏洞
Cassia Networks Access Controller is an application from Cassia USA, Inc. provides a powerful IoT network management solution. Cassia Networks Access Controller suffers from a path traversal vulnerability that can be exploited by an attacker to view any file on a server using a relative path...
Catalog Traversal Vulnerability in the Integrated Management Platform of Beijing Zhongcheng Kexin Technology Development Co.
Beijing Zhongcheng Kexin Technology Development Co., Ltd. is a leading tourism industry chain service provider with high market share in China, and is the preferred brand of China's intelligent tourism informatization construction and regional tourism operation services. There is a directory...
CVE-2021-24154
The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the downloadfile function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd...
UBUNTU-CVE-2021-22203
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all versions starting from 13.10 before 13.10.1. A specially crafted Wiki page allowed attackers to read arbitrary files on the server...
CVE-2021-22201
Removed by vendor...
PT-2021-14912 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.9 and later Description: An issue has been discovered in GitLab CE/EE where a specially crafted import file could read files on the server. Recommendations: For GitLab CE/EE versions 13.9 and later, consider restricti...
Arbitrary File Read Vulnerability in Doco Knowledge Management System
DuoKe knowledge management system is a professional enterprise-level system, the main functions of content management display, knowledge document re-organization and processing, network-based similar word online editing system, user points, the latest knowledge and many other expanded functions, ...
Invigo Automatic Device Management 路径遍历漏洞
Invigo Automatic Device Management ADM is a native management tool for cellular operators that enables them to detect, maintain and manage millions of devices cost-effectively and with a high degree of reliability. A directory traversal vulnerability exists in /admin/searchby.php in Invigo...
CVE-2020-10584
A directory traversal on the /admin/searchby.php script of Invigo Automatic Device Management ADM through 5.0 allows remote attackers to read arbitrary server files accessible to the user running the application...
Directory traversal
A directory traversal on the /admin/searchby.php script of Invigo Automatic Device Management ADM through 5.0 allows remote attackers to read arbitrary server files accessible to the user running the application...
Arbitrary File Read Vulnerability in HIM Basic Management Platform of Beijing Zhongchuang Vision Technology Co.
Ltd. is a high-tech company specializing in the research and development of video conference system hardware and software. There is an arbitrary file reading vulnerability in the HIM basic management platform of Beijing CCTV Technology Co., Ltd, which can be exploited by an attacker to read all t...
Jellyfin 路径遍历漏洞
Jellyfin is a freeware media system. It allows you to control the management and streaming of media. It is an alternative to the proprietary Emby and Plex, allowing media from dedicated servers to be served to end-user devices through multiple applications. A security vulnerability exists in...
Fluig 1.7.0 - Path Traversal Exploit
Exploit Title: Fluig 1.7.0 - Path Traversal Exploit Author: Lucas Souza Vendor Homepage: https://www.totvs.com/fluig/ Version: payload.txt curl -s https://raw.githubusercontent.com/lucxssouza/banners/main/xFluig/banner banner -- FUNCTIONS -- function create-payload wordlist.txt count=1 while $cou...
Design/Logic Flaw
LumisXP aka Lumis Experience Platform before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service...