16895 matches found
Samsung Mobile CallBGProvider 访问控制错误漏洞
Samsung CallBGProvider is an app from Samsung South Korea. A security vulnerability exists in Samsung CallBGProvider that stems from CallBGProvider's failure to properly access control components in CallBGProvider prior to SMR JUN-2021 Release 1 version. A local attacker can exploit the...
Samsung SMR 安全漏洞
Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists prior to SMR june -2021 Release 1, which stems from an incorrect purge of the intrusion intent in Samsung Contacts that can be exploited by a local...
Path Traversal in Django
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if and only if the default admindocs templates have been...
AGG Software Web Server 路径遍历漏洞
Web Server is a simple but fast and robust web server from AGG Software. A security vulnerability exists in AGG Software Web Server that stems from the vulnerability of the affected product to a path traversal attack, where an attacker may be able to read arbitrary files from the file system...
SUSE SLES11 Security Update : clamav (SUSE-SU-2021:14592-1)
The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14592-1 advisory. - A vulnerability in the Data-Loss-Prevention DLP module in Clam AntiVirus ClamAV Software versions 0.102.1 and 0.102.0 could allow an...
FreeBSD : dino -- Path traversal in Dino file transfers (fc1bcbca-c88b-11eb-9120-f02f74d0e4bd)
Dino team reports : It was discovered that when a user receives and downloads a file in Dino, URI-encoded path separators in the file name will be decoded, allowing an attacker to traverse directories and create arbitrary files in the context of the user. %NASLMINLEVEL 70300 C Tenable Network...
Privilege Escalation
checkpath in OpenRC is vulnerable to privilege escalation. It was possible for local users to take ownership of arbitrary files via a symlink in a non-terminal path component...
CVE-2021-33203
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if and only if the default admindocs templates have been...
Directory traversal
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if and only if the default admindocs templates have been...
CVE-2021-3277
Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files...
Code injection
IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to read and delete arbitrary files on the system. IBM X-Force ID: 198435...
USN-4975-2 python-django vulnerability
USN-4975-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Rasmus Lerchedahl Petersen and Rasmus Wriedt Larsen discovered that Django incorrectly handled path sanitation in admindocs. A remote attacker could possibly...
CVE-2020-36005
AppCMS 2.0.101 in /admin/app.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site...
AppCMS 安全漏洞
AppCMS is a content management system CMS for mobile application downloads. A security vulnerability exists in AppCMS version 2.0.101, which can be exploited by an attacker to delete arbitrary files on the site...
Synology Download Station Server-Side Request Forgery Vulnerability
Synology Download Station is a browser extension. It allows you to browse the Download Center suite of active and downloaded tasks and add tasks without accessing the web version of Synology. A server-side request forgery vulnerability exists in Synology Download Station before 3.8.15-3563, which...
GHSA-J858-XP5V-F8XX Dragonfly contains remote code execution vulnerability
An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process features...
CVE-2020-6950
Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter...
Directory traversal
Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter...
