CVE-2018-25145: Files or Directories Accessible to External Parties

Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configuration files. Attackers can retrieve configuration files from multiple directories including '/www', '/etc/mcli/', and '/tmp' to access syst...

CVE-2023-53974: Missing Authentication for Critical Function

D-Link DSL-124 ME1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router settings through a POST request. Attackers can send a specific POST request to the router's configuration endpoint to download a complete backup file containing...

CVE-2016-15056 Ubee EVW3226 Unauthenticated Backup File Disclosure

Ubee EVW3226 cable modem/routers firmware versions up to and including 1.0.20 store configuration backup files in the web root after they are generated for download. These backup files remain accessible without authentication until the next reboot. A remote attacker on the local network can reque...

CVE-2024-29225

ELECOM wireless LAN routers are vulnerable to an information disclosure vulnerability (CWE-200 ) where a network-adjacent unauthenticated attacker can obtain a configuration file containing sensitive information by sending a specially crafted request. This affects ELECOM WRC-G01-W versions 1.24 a...

PT-2021-20606

Name of the Vulnerable Software and Affected Versions: WordPress Download Manager versions 3.1.24 and prior versions Description: The issue allows authenticated users with Contributor+ roles to obtain sensitive configuration file information. Additionally, Author+ users can perform XSS attacks by...

CVE-2021-30357

SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing files to which the user did not have access...

ELOG < 3.1.4-283534d Multiple Vulnerabilities - Active Check

ELOG is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elogproject:elog"; ifdescription...

Zend Framework 1.11.11 Database Configuration Disclosure

Exploit Title : Zend Framework 1.11.11 Database Config Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/02/2019 Vendor Homepage : zend.com Software Download Link : zend.com/en/company/community/framework/downloads Software Information Link :...

TP-Link Archer C50 Wireless Router 171227 - CSRF (Configuration File Disclosure) Vulnerability

Exploit for hardware platform in category web applications Exploit Title: TP-Link Archer C50 Wireless Router 171227 - Cross-Site Request Forgery Configuration File Disclosure Exploit Author: Wadeek Vendor Homepage: https://www.tp-link.com/ Hardware Version: Archer C50 v3 00000001 Firmware Link:...

TP-Link Archer C50 Wireless Router 171227 - Cross-Site Request Forgery (Configuration File Disclosure)

TP-Link Archer C50 Wireless Router 171227 - Cross-Site Request Forgery Configuration File Disclosure Exploit Title: TP-Link Archer C50 Wireless Router 171227 - Cross-Site Request Forgery Configuration File Disclosure Date: 2018-11-07 Exploit Author: Wadeek Vendor Homepage: https://www.tp-link.com...

TP-Link Archer C50 Wireless Router 171227 - Cross-Site Request Forgery (Configuration File Disclosure)

Exploit Title: TP-Link Archer C50 Wireless Router 171227 - Cross-Site Request Forgery Configuration File Disclosure Date: 2018-11-07 Exploit Author: Wadeek Vendor Homepage: https://www.tp-link.com/ Hardware Version: Archer C50 v3 00000001 Firmware Link:...

NEC Univerge SV9100/SV8100 WebPro 10.0 - Configuration Download

NEC Univerge SV9100/SV8100 WebPro 10.0 Remote Configuration Download Vendor: NEC Corporation Product web page: http://www.nec.com Affected version: WebPro =10.00 DSP Firmware Version: 12.11.00.02 Summary: NEC's UNIVERGE® SV9100 is the unified communications UC solution of choice for small and...

CVE-2017-5674

A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP "GET system.ini HTTP/1.1\n\n" - note the lack of "/" in the path field of the request request that will disclose the configuration...

SentryHD 02.01.12e - Local Privilege Escalation

''' Exploit Title: SentryHD 02.01.12e Privilege Escalation Date: 18-01-2017 Software Link: http://www.minutemanups.com/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: local 1. Description Every user can read: c:\Program Files...

Zend Framework Configuration File Disclosure Vulnerability

Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services. Zend Framework has a configuration file disclosure vulnerability that can be exploited by an attacker to download...

CVE-2016-4494

Cross-site request forgery CSRF vulnerability on KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allows remote attackers to hijack the authentication of unspecified victims for requests that disclose the contents of a configuration file...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability on KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allows remote attackers to hijack the authentication of unspecified victims for requests that disclose the contents of a configuration file...

CVE-2016-4494

CVE-2016-4494 affects KMC Controls BAC-5051E routers with firmware prior to E0.2.0.2. The vulnerability is a cross-site request forgery (CSRF) that allows an unauthenticated or remote attacker to hijack a user’s session and read the device’s configuration contents via the web interface. Connected...

CVE-2016-4494: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability on KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allows remote attackers to hijack the authentication of unspecified victims for requests that disclose the contents of a configuration file...

PT-2016-5977

Name of the Vulnerable Software and Affected Versions KMC Controls BAC-5051E devices with firmware prior to E0.2.0.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of victims for requests that disclose the contents of a configuration file...