CVE-2019-7195

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions...

CVE-2019-7195

CVE-2019-7195 is a QNAP Photo Station external file name/path control vulnerability. The CVE affects QNAP Photo Station on QTS with Photo Station versions prior to the fixes listed in QNAP NAS advisory NAS-201911-25 and related vendor advisories. The underlying issue is a path traversal/ improper...

CVE-2019-7194

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions...

CVE-2019-7194

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions...

XML External Entity (XXE)

odata-server-core is vulnerable to XML external entity XXE attacks. The support for external entities are not disabled and allows remote attackers to inject a malicious XML document to retrieve confidential system files or perform requests on behalf of the server...

CVE-2019-7195

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker...

CVE-2019-7194

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker...

NewStart CGSL CORE 5.04 / MAIN 5.04 : gvfs Vulnerability (NS-SA-2019-0224)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has gvfs packages installed that are affected by a vulnerability: - An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users...

Allied Telesis AT-GS950/8 Directory Traversal Vulnerability

Exploit for hardware platform in category web applications ============================================= CVEID: CVE-2019-18922 NAME OF AFFECTED PRODUCT: Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 1.00.047 PROBLEM TYPE: Directory Traversal DESCRIPTION: A Directory Traversal in the We...

Allied Telesis AT-GS950/8 Directory Traversal

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ============================================= CVEID: CVE-2019-18922 NAME OF AFFECTED PRODUCT: Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 1.00.047 PROBLEM TYPE: Directory Traversal DESCRIPTION: A Directory Traversal in the Web interface...

Directory traversal

A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 1.00.047 allows unauthenticated attackers to read arbitrary system files via a GET request. NOTE: This is an End-of-Life product...

CVE-2019-18922

A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 1.00.047 allows unauthenticated attackers to read arbitrary system files via a GET request. NOTE: This is an End-of-Life product...

GNU Mailutils 3.7 - Privilege Escalation Exploit

Exploit Title: GNU Mailutils 3.7 - Local Privilege Escalation Date: 2019-11-06 Exploit Author: Mike Gualtieri Vendor Homepage: https://mailutils.org/ Software Link: https://ftp.gnu.org/gnu/mailutils/mailutils-3.7.tar.gz Version: 2.0 = 3.7 Tested on: Gentoo CVE : CVE-2019-18862 Title : GNU Mailuti...

XML External Entities (XXE)

jackson-mapper-asl is vulnerable to XML external entity attacks. This vulnerability is similar to CVE-2016-3720 whereby the external DTD is not disabled, allowing an attacker to retrieve system files, or perform requests on behalf of the server using malicious XML documents...

TopCloud self-service website builder system exists arbitrary file deletion vulnerability

The top cloud station system is Chongqing Chujie Technology Co., Ltd. independent research and development "PC + cell phone + micro site + shopping" integration of the whole network marketing PHP enterprise intelligent station software. TopCloud self-service website builder system there are...

Symlink Attack

github.com/helm/helm is vulnerable to symlink attack. During loading or packaging of a chart as a directory, a malicious chart containing symlinks could be used to obtain system files such as /etc/passwd. The vulnerability can also be used to cause a denial of service condition when special files...

CVE-2019-1385

An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate...

Windows AppX Deployment Extensions Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files. To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privilege...

EulerOS 2.0 SP5 : gvfs (EulerOS-SA-2019-2156)

According to the version of the gvfs packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileg...

PT-2019-4228 · Microsoft · Windows Appx Deployment Server +1

Name of the Vulnerable Software and Affected Versions: Microsoft Windows AppX Deployment Server affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows AppX Deployment Server component, allowing an attacker to elevate their privileges. ...