CVE-2020-36883 SpinetiX Fusion Digital Signage 3.4.8 Authenticated Path Traversal via File Operations

SpinetiX Fusion Digital Signage 3.4.8 and lower contains an authenticated path traversal vulnerability that allows attackers to manipulate file backup and deletion operations through unverified input parameters. Attackers can exploit path traversal techniques in index.php to write backup files to...

CVE-2020-36883

CVE-2020-36883 affects SpinetiX Fusion Digital Signage

SpinetiX Fusion Digital Signage 路径遍历漏洞

SpinetiX Fusion Digital Signage is a digital signage software from SpinetiX Switzerland. A path traversal vulnerability exists in SpinetiX Fusion Digital Signage version 3.4.8 and prior versions, which stems from an unvalidated input parameter and could lead to a path traversal attack...

SpinetiX Fusion Digital Signage 安全漏洞

SpinetiX Fusion Digital Signage is a digital signage software from SpinetiX Switzerland. A security vulnerability exists in SpinetiX Fusion Digital Signage version 3.4.8, which originates from unauthorized access to the database backup directory and could lead to information disclosure...

SpinetiX Fusion Digital Signage 安全漏洞

SpinetiX Fusion Digital Signage is a digital signage software from SpinetiX Switzerland. A security vulnerability exists in SpinetiX Fusion Digital Signage version 3.4.8, which originates from the presence of a username enumeration in the login script, which could lead to the disclosure of accoun...

PT-2025-50507

Name of the Vulnerable Software and Affected Versions SpinetiX Fusion Digital Signage versions 3.4.8 and lower Description The software contains an authenticated path traversal flaw. This allows attackers to manipulate file backup and deletion operations using unverified input parameters...

PT-2025-50510

SpinetiX Fusion Digital Signage 3.4.8 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that automatically submits a form to create a new admin user with full...

PT-2025-50512

SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts. Attackers can send crafted login requests with different usernames to distinguish between existing and non-existing accounts by analyzing...

SpinetiX Fusion Digital Signage 跨站请求伪造漏洞

SpinetiX Fusion Digital Signage is a digital signage software from SpinetiX Switzerland. A cross-site request forgery vulnerability exists in SpinetiX Fusion Digital Signage version 3.4.8, which stems from a lack of request validation and could lead to a cross-site request forgery attack...

CVE-2020-36888: Observable Discrepancy

SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts. Attackers can send crafted login requests with different usernames to distinguish between existing and non-existing accounts by analyzing...

CVE-2020-36887: Cleartext Storage of Sensitive Information

SpinetiX Fusion Digital Signage 3.4.8 contains an unauthenticated information disclosure vulnerability in the database backup directory. Attackers can access the /content/files/backups/ endpoint to download sensitive backup files containing user credentials and system information...

CVE-2020-36883: Improper Limitation of a Pathname to a Restricted Directory

SpinetiX Fusion Digital Signage 3.4.8 and lower contains an authenticated path traversal vulnerability that allows attackers to manipulate file backup and deletion operations through unverified input parameters. Attackers can exploit path traversal techniques in index.php to write backup files to...

CVE-2020-36886: Cross-Site Request Forgery (CSRF)

SpinetiX Fusion Digital Signage 3.4.8 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that automatically submits a form to create a new admin user with full...

EUVD-2020-7792

Malware in sbrugna...

CVE-2020-15809

spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP400W through 4.5.2-1.0.2-1eb2ffbd; and DSOS through 4.5.2-1.0.2-1eb2ffbd...

CVE-2020-15809

spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP400W through 4.5.2-1.0.2-1eb2ffbd; and DSOS through 4.5.2-1.0.2-1eb2ffbd...

Path traversal

spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP400W through 4.5.2-1.0.2-1eb2ffbd; and DSOS through 4.5.2-1.0.2-1eb2ffbd...

CVE-2020-15809

spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP400W through 4.5.2-1.0.2-1eb2ffbd; and DSOS through 4.5.2-1.0.2-1eb2ffbd...

CVE-2020-15809

CVE-2020-15809 affects SpinetiX devices via spxmanage, enabling SSRF and Path Traversal to access unintended resources. Affected are: HMP350, HMP300 and DiVA up to 4.5.2-1.0.36229; HMP400 and HMP400W up to 4.5.2-1.0.2-1eb2ffbd; and DSOS up to 4.5.2-1.0.2-1eb2ffbd. Root cause is SSRF/Path Traversa...

PT-2021-9835

Name of the Vulnerable Software and Affected Versions SpinetiX HMP350 versions 4.5.2-1.0.36229 and earlier SpinetiX HMP300 versions 4.5.2-1.0.36229 and earlier SpinetiX DiVA versions 4.5.2-1.0.36229 and earlier SpinetiX HMP400 versions 4.5.2-1.0.2-1eb2ffbd and earlier SpinetiX HMP400W versions...