Remote File Download Vulnerability in Light CMS

Line CMS is an intelligent website building system built in PHP+MYSQL environment. A remote file download vulnerability exists in Line CMS, which allows an attacker to download any type of file to a local server to gain access to the web server...

CMS Made Simple Remote Code Execution Vulnerability (CNVD-2018-06398)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism , etc. File Manager is one of the file management component ....

File upload vulnerability in ask2 Q&A frontend

ask2 Q&A is an open source PHP Q&A program. A file upload vulnerability exists in the frontend of ask2 Q&A System. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

CVE-2018-7654

On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path traversal...

Path traversal

On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path traversal...

OTRS Command Injection

Exploit Title: OTRS Authenticated file upload Date: 03-03-2018 Exploit Author: Ali BawazeEer Vendor Homepage: https://www.otrs.com/ Software Link: http://ftp.otrs.org/pub/otrs/ Version:5.0.2, 5.0.0 - 5.0.24, 6.0.0 - 6.0.1 Tested on: OTRS 5.0.2/CentOS 7.2.1511 CVE : CVE-2018-7567 Vulnerability...

CVE-2016-0291

IBM BigFix Platform 9.0, 9.1 before 9.1.8, and 9.2 before 9.2.8 allow remote authenticated users to execute arbitrary commands by leveraging report server access. IBM X-Force ID: 111302...

Code injection

IBM BigFix Platform 9.0, 9.1 before 9.1.8, and 9.2 before 9.2.8 allow remote authenticated users to execute arbitrary commands by leveraging report server access. IBM X-Force ID: 111302...

CVE-2016-0291

IBM BigFix Platform 9.0, 9.1 before 9.1.8, and 9.2 before 9.2.8 allow remote authenticated users to execute arbitrary commands by leveraging report server access. IBM X-Force ID: 111302...

Code Execution Vulnerability in CmsEasy v5.7

CMSeasy is a web content management system based on PHP+Mysql architecture and a PHP development platform. The use of modular development, easy to use features easy to expand, can be oriented to large and medium-sized sites to provide heavyweight website construction solutions. CmsEasy v5.7 versi...

CVE-2018-2390

Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server IGS, 7.20, 7.20EXT, 7.45, 7.49, 7.53, via IGS Chart service...

DS Data Systems KonaKart eCommerce Platform Directory Traversal Vulnerability

DS Data Systems KonaKart eCommerce Platform is a Java-based eCommerce software from DS Data Systems, UK. The software enhances modules such as shopping cart, payment and order summarization. A directory traversal vulnerability exists in the administration panel of DS Data Systems KonaKart eCommer...

Spring Security and Spring Framework Authentication Bypass Vulnerability

Spring Security is a set of Spring-based applications to provide illustrative security protection of the security framework.Spring Framework is the United States Pivotal Corporation's set of open source Java, Java EE application framework. Spring Security and Spring Framework authentication bypas...

Path traversal

Path traversal vulnerability in the administrative panel in KonaKart eCommerce Platform version 8.7 and earlier could allow an attacker to download system files, as well as upload specially crafted JSP files and in turn gain access to the server...

CVE-2017-17108

Path traversal vulnerability in the administrative panel in KonaKart eCommerce Platform version 8.7 and earlier could allow an attacker to download system files, as well as upload specially crafted JSP files and in turn gain access to the server...

CVE-2017-17108

Path traversal vulnerability in the administrative panel in KonaKart eCommerce Platform version 8.7 and earlier could allow an attacker to download system files, as well as upload specially crafted JSP files and in turn gain access to the server...

CVE-2017-17108

Path traversal vulnerability in the administrative panel in KonaKart eCommerce Platform version 8.7 and earlier could allow an attacker to download system files, as well as upload specially crafted JSP files and in turn gain access to the server...

JVN#15643848: Spring Security and Spring Framework vulnerable to authentication bypass

Spring Framework and Spring Security provided by Pivotal Software, Inc. contain an authentication bypass vulnerability. Impact A remote attacker can bypass authentication. As a result, the attacker gains access to the server and information may be disclosed. Solution Update the Software Update to...

Multiple Vulnerabilities in Beipiao's Microclass App

Beipiao Microcourse APP is an educational course learning service software. There are loopholes in Beipiao Microcourse APP for arbitrary user registration, arbitrary user password reset and arbitrary file upload. An attacker can use the vulnerability to register any account, reset any password an...

File Upload Vulnerability in Thunderwind Movie CMS V3.3.0 UsersController.class.php Page

Thunderwind Movie CMS is a PHP based THINKPHP3.2.3 framework development, suitable for all kinds of video, film and television websites, film and television content management program. Thunderwind Movie CMS V3.3.0 File upload vulnerability exists in the UsersController.class.php page. Allows an...