Arbitrary File Deletion Vulnerability in Gila CMS

Gila CMS is an open source content management system. Gila CMS suffers from an arbitrary file deletion vulnerability that can be exploited by an attacker to delete arbitrary files from the server...

Arbitrary File Download Vulnerability in TrueCMS

TrueCMS is a website management system. TrueCMS suffers from an arbitrary file download vulnerability, which can be exploited by an attacker to download arbitrary files from the server and disclose sensitive information...

OurPHP has an arbitrary file deletion vulnerability

OurPHP is an enterprise e-commerce website builder. OurPHP has an arbitrary file deletion vulnerability, which can be exploited by attackers to delete arbitrary files on the server...

Joomla com_fabrik 3.9.11 - Directory Traversal Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! comfabrik 3.9.11 - Directory Traversal Google Dork: inurl:"index.php?option=comfabrik" Exploit Author: qw3rTyTy Vendor Homepage: https://fabrikar.com/ Software Link: https://fabrikar.com/downloads Version: 3.9 Tested on:...

CVE-2020-7480

A CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exists in Andover Continuum All versions, which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data...

Arbitrary File Read Vulnerability in Five Fingers CMS

Five fingers CMS is a high-performance open source content management system , support for LNAMP architecture , suitable for portals , corporate Web site , mobile site , microblogging promotion. Five Fingers CMS arbitrary file reading vulnerability , an attacker can exploit the vulnerability to...

Chadha PHPKB path traversal vulnerability (CNVD-2020-18322)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A path traversal vulnerability exists in admin/assetmanager/assetmanager.php in Chadha PHPKB Standard Multi-Language 9. An attacker...

CVE-2020-10459

Path Traversal in admin/assetmanager/assetmanager.php vulnerable function saved in admin/assetmanager/functions.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to list the files that are stored on the webserver using a dot-dot-slash sequence ../ via the POST parameter inpCurrFolder...

CVE-2020-9044

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server ADS, ADS-Lite versions 10.1 and prior; Metasys Extended Application and...

PT-2020-20457

Name of the Vulnerable Software and Affected Versions Metasys Application and Data Server ADS, ADS-Lite versions prior to 10.1 Metasys Extended Application and Data Server ADX versions prior to 10.1 Metasys Open Data Server ODS versions prior to 10.1 Metasys Open Application Server OAS version 10...

CVE-2020-6768

A path traversal vulnerability in the Bosch Video Management System BVMS NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 = 10.0.0.1225, 9.0 = 9.0.0.827, 8.0 = 8.0.329 and 7.5 and older. This affect...

CVE-2020-7953

An issue was discovered in OpServices OpMon 9.3.2. Without authentication, it is possible to read server files e.g., /etc/passwd due to the use of the nmap -iL aka input file option...

CVE-2020-7953

An issue was discovered in OpServices OpMon 9.3.2. Without authentication, it is possible to read server files e.g., /etc/passwd due to the use of the nmap -iL aka input file option...

Xxe

An XML External Entity XEE vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders...

Input validation

An issue was discovered in OpServices OpMon 9.3.2. Without authentication, it is possible to read server files e.g., /etc/passwd due to the use of the nmap -iL aka input file option...

CVE-2020-7953

CVE-2020-7953 affects OpServices OpMon 9.3.2. The issue allows reading server files (e.g., /etc/passwd) without authentication due to the use of nmap -iL (input file) option. Multiple connected sources (including Red Hat and CNVD entries) corroborate this description. The vulnerability impacts co...

CVE-2020-7953: Missing Authentication for Critical Function

An issue was discovered in OpServices OpMon 9.3.2. Without authentication, it is possible to read server files e.g., /etc/passwd due to the use of the nmap -iL aka input file option...

CVE-2020-3938

SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into network architecture or system files of the server via forged inquests...

CVE-2020-6767

A path traversal vulnerability in the Bosch Video Management System BVMS FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 = 10.0.0.1225, 9.0 = 9.0.0.827, 8.0 = 8.0.329 and 7.5 and older. This affects...

Squiz Matrix CMS Arbitrary File Deletion Vulnerability

Squiz Matrix CMS is an open source content management system with a highly usable interface. An arbitrary file deletion vulnerability exists in core/assets/form/form/formquestiontypes/formquestiontypefileupload/formquestiontypefileupload.inc in Squiz Matrix CMS. An attacker can exploit this...