CVE-2018-21007

The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads...

CVE-2018-21007

The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads...

Design/Logic Flaw

The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads...

CVE-2018-21007

The CVE-2018-21007 entry affects the WordPress plugin woo-confirmation-email before version 3.2.0 . The vulnerability is an authorization flaw: the plugin does not block direct access to supportive files/folders inside the WordPress uploads directory, exposing potentially sensitive uploaded conte...

CVE-2019-13984

Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File...

Access Control Vulnerabilities in Multiple ZyXEL Products

ZyXEL ZyWall 310 and others are products of Taiwan, China-based ZyXEL Corporation.ZyXEL ZyWall 310 is a 310 series VPN firewall appliance.ZyXEL ZyWall 110 is a 110 series VPN firewall appliance.ZyXEL USG1900 is a next-generation unified security gateway appliance. A security vulnerability exists ...

Multiple F5 Products Security Bypass Vulnerabilities

F5 BIG-IP APM and so on are the products of F5 Corporation in the U.S.A. F5 BIG-IP APM is a set of access and security solutions.F5 BIG-IP is an application delivery platform that integrates the functions of network traffic management, application security management, and load balancing, etc. F5...

CVE-2019-3569

HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versio...

Optergy Proton/Enterprise Authentication Error Vulnerability

Optergy Proton/Enterprise is an enterprise building management system from Optergy USA. An authentication error vulnerability exists in Optergy Proton/Enterprise versions 2.3.0a and earlier. An attacker could exploit the vulnerability to gain direct party access to specific resources...

Siemens SCALANCE W1750D 6GK5750-2HX01-1AA0 Controller-based Direct Access Point

Binary data 764354.prm...

September 20, 2018—KB4457141 (OS Build 15063.1358)

None None...

SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change

Exploit Title: SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Shodan Dork: SDT-CW3B1 Date: 2018-05-23 Exploit Author: Safak Aslan Vendor Homepage: http://telesquare.co.kr/ Version: SKT CW3B1 sw version 1.2.0 Tested on: Windows CVE: - Class: Unauthorized Admin Credential Change...

Information disclosure

Avolve Software ProjectDox 8.1 allows remote authenticated users to obtain sensitive information from other users via vectors involving a direct access token...

CVE-2014-5130

The CVE-2014-5130 entry applies to Avolve Software ProjectDox 8.1 . The vulnerability is described as an information disclosure where remote authenticated users can obtain sensitive data from other users via vectors involving a direct access token. The connected documentation confirms multiple re...

CVE-2017-17898

Dolibarr ERP/CRM version 6.0.4 does not block direct requests to .tpl.php files, which allows remote attackers to obtain sensitive information...

CVE-2017-17898

Dolibarr ERP/CRM version 6.0.4 does not block direct requests to .tpl.php files, which allows remote attackers to obtain sensitive information...

NPM-V (Network Power Manager) 2.4.1 - Password Reset

NPM-V Network Power Manager 2.4.1 - Password Reset NPM-VNetwork Power Manager = 2.4.1 Reset Password Vulnerability Author: Saeed reza Zamanian penetrationtest @ Linkedin Product: NPM-V Affected Version : 2.4.1 and below Vendor : http://www.china-clever.com Product Link :...

VMSA-2017-0012:VMware VIX API VM Direct Access Function security issue

VMSA-2017-0012 VMware VIX API VM Direct Access Function security issue VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2017-0012 VMware Security Advisory Severity: Important VMware Security Advisory Synopsis: VMware VIX API VM Direct Access Function security issue VMware...

kernel: race condition between direct and memory-mapped I/O in fs/xfs/xfs_aops.c

It was found that the Linux kernel can hit a BUGON statement in the xfsgetblocks in the fs/xfs/xfsaops.c because of a race condition between direct and memory-mapped I/O associated with a hole in a file that is handled with BUGON instead of an I/O failure. This allows a local unprivileged attacke...

NetScaler: Error - "your apps are not available at this time" when login from Receiver

NetScaler: Error - "your apps are not available at this time" when login from Receiver. This occurs when going via the NetScaler gateway . Direct access to SF works fine, as well as browser access to gateway works fine...