Harbin Weicheng Technology Co., Ltd. OurPHP has an arbitrary file deletion vulnerability

OurPHP is a PHP+MySQL based development of W3C-compliant website building system. Harbin Weicheng Technology Co., Ltd OurPHP has an arbitrary file deletion vulnerability that can be exploited by an attacker to delete any system files, and can further lead to the system being reinstalled...

Unauthorized Access Vulnerability in Cloud Box Fortresses

Cloud Box is a security management tool for tenants to connect to cloud resources, helping cloud tenants manage virtual machines, databases, and other resources on the cloud more securely and granularly. An unauthorized access vulnerability exists in Cloud Box Fortress, which can be exploited by ...

xyhcms background exists arbitrary file download vulnerability

xyhcms is a completely open source CMS content management system, simple, easy to use, secure, stable and free. xyhcms background arbitrary file download vulnerability , attackers can exploit the vulnerability to download sensitive system files...

WSO2 API Manager Carbon Interface 3.0.0 File Delete

Document Title: =============== WOS2 API ManagerDelete Extension Arbitrary File DeletePath traversal CVE not assigned yet Author : Raki Ben Hamouda Security Update : https://apim.docs.wso2.com/en/latest/ Common Vulnerability Scoring System: ==================================== 8.5 Affected...

Cross-site Request Forgery (CSRF)

cups is vulnerable to cross-site request forgery CSRF. The vulnerability exists as a remote attacker could trick a user, who is logged into the CUPS web interface as an administrator, into visiting a specially-crafted website, the attacker could reconfigure and disable CUPS, and gain access to...

CVE-2020-10263

An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.52.4. Attackers can get root shell by accessing the UART interface and then they can i read Wi-Fi SSID or password, ii read the dialogue text files between users and XIAOMI XIAOAI speaker Pro LX06, iii use Text-To-Speech tools pretend...

Command injection

An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.58.10. Attackers can activate the failsafe mode during the boot process, and use the miconsole command cascaded by the SN code shown on the product to get the root shell password, and then the attacker can i read Wi-Fi SSID or password, ...

CVE-2020-10263

An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.52.4. Attackers can get root shell by accessing the UART interface and then they can i read Wi-Fi SSID or password, ii read the dialogue text files between users and XIAOMI XIAOAI speaker Pro LX06, iii use Text-To-Speech tools pretend...

CVE-2020-10262

An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.58.10. Attackers can activate the failsafe mode during the boot process, and use the miconsole command cascaded by the SN code shown on the product to get the root shell password, and then the attacker can i read Wi-Fi SSID or password, ...

CVE-2020-1985

Incorrect Default Permissions on C:\Programdata\Secdo\Logs folder in Secdo allows local authenticated users to overwrite system files and gain escalated privileges. This issue affects all versions Secdo for Windows. Recent assessments: xFreed0m at April 10, 2020 3:06pm UTC reported: CVE-2020-1985...

CVE-2020-10508

Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information...

Information disclosure

Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information...

CVE-2020-10508

CVE-2020-10508 affects Sunnet eHRD, a human training and development management system. The vulnerability is an information-disclosure flaw caused by improper storage of system files, enabling an attacker to access confidential information via a specific URL. Multiple sources (NVD and CVE lists) ...

CVE-2020-10508 Sunnet eHRD - Sensitive Data Exposure

Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information...

Sunnet eHRD Information Disclosure Vulnerability

Sunnet eHRD is a talent training and development management system. An information disclosure vulnerability exists in Sunnet eHRD. The vulnerability stems from eHRD improperly storing system files. An attacker can exploit the vulnerability to obtain confidential information via a specific URL...

Catfish CMS backend In***.php file has arbitrary file deletion vulnerability

Catfish CMS is open source and free PHP content management system. Catfish CMS background In.php file exists arbitrary file deletion vulnerability. Attackers can use this vulnerability to delete system files, resulting in a system crash...

Visual Studio Extension Installer Service Denial of Service Vulnerability

A denial of service vulnerability exists when the Visual Studio Extension Installer Service improperly handles hard links. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. To exploit this vulnerability, an attacker would have to log on to an...

Windows Tile Object Service Denial of Service Vulnerability

A denial of service vulnerability exists when the Windows Tile Object Service improperly handles hard links. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. To exploit this vulnerability, an attacker would have to log on to an affected syst...

The vulnerability of the High Availability service of the Cisco Smart Software Manager On-Prem administration tool allows a hacker to gain access to read and write system files.

The vulnerability of the Cisco Smart Software Manager On-Premise administration software’s high availability feature is related to the presence of a statistical password for the standard account. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to read and...

CVE-2020-8635

Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and escalate privileges within the operating system by modifying system files...