ASUS BMC Firmware Path Traversal Vulnerability

ASUS BMC Firmware is a firmware from Asus China. ASUS BMC suffers from a path traversal vulnerability, which can be exploited by an attacker to gain administrator privileges to access system files via path traversal...

Remote code execution

Discord Recon Server is a bot that allows one to do one's reconnaissance process from one's Discord. A vulnerability in Discord Recon Server prior to 0.0.3 could be exploited to read internal files from the system and write files into the system resulting in remote code execution. This issue has...

CVE-2021-29461

Discord Recon Server prior to version 0.0.3 contains a vulnerability that can be exploited to read internal files and write files on the system, resulting in remote code execution. The issue is fixed in version 0.0.3. As a workaround, patch code from assets/CommandInjection.py in the project repo...

XML External Entity (XXE)

Wordpress is vulnerable to XML external entity attack. A user with the ability to upload files like an Author is able to exploit an XML external entity vulnerability in the Media Library to retrieve arbitrary system files...

OpenVPN Connect Backlink Vulnerability

OpenVPN Connect is a VPN Virtual Private Network client application from the American company OpenVPN Openvpn. A backlink vulnerability exists in OpenVPN Connect installer for macOS 3.2.6 and earlier versions, which stems from the fact that the installer can corrupt critical system files. No...

ASUS BMC Firmware Path Traversal Vulnerability (CNVD-2021-36266)

ASUS BMC Firmware is a firmware from Asus China. The ASUS BMC Firmware suffers from a path traversal vulnerability that stems from the Record video file function not filtering specific parameters. A remote attacker could use this vulnerability to gain administrator privileges and then traverse...

CVE-2021-28205

The specific function in ASUS BMC’s firmware Web management page Delete SOL video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28207

The specific function in ASUS BMC’s firmware Web management page Get Help file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28205

The specific function in ASUS BMC’s firmware Web management page Delete SOL video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28209

The specific function in ASUS BMC’s firmware Web management page Delete video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28208

The specific function in ASUS BMC’s firmware Web management page Get video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28209

The specific function in ASUS BMC’s firmware Web management page Delete video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28206

The specific function in ASUS BMC’s firmware Web management page Record video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

Path traversal

The specific function in ASUS BMC’s firmware Web management page Delete video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

Path traversal

The specific function in ASUS BMC’s firmware Web management page Get video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

Path traversal

The specific function in ASUS BMC’s firmware Web management page Get Help file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

Path traversal

The specific function in ASUS BMC’s firmware Web management page Record video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

Path traversal

The specific function in ASUS BMC’s firmware Web management page Delete SOL video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28209 ASUS BMC's firmware: path traversal - Delete video file function

The specific function in ASUS BMC’s firmware Web management page Delete video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28209

The CVE-2021-28209 issue affects ASUS BMC firmware Web management (Delete video file function). A parameter is not properly filtered, enabling path traversal to access system files. According to multiple sources, remote attackers with administrator privileges can exploit this to read restricted f...