870 matches found
PT-2019-13913
Name of the Vulnerable Software and Affected Versions eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn versions prior to 2.3.0 Description The issue allows administrative operations to be performed by unauthenticated attackers who have access to the web interface. This is because certain features...
CVE-2018-12299
Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names...
GodOfWar - Malicious Java WAR Builder With Built-In Payloads
A command-line tool to generate war payloads for penetration testing / red teaming purposes, written in ruby. Features Preexisting payloads. try -l/--list cmdget filebrowser bindshell reverseshell reverseshellui Configurable backdoor. try --host/-port Control over payload name. To avoid malicious...
Directory traversal
A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files...
CVE-2019-10632
A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files...
CVE-2019-10632
A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files...
CVE-2019-10632
CVE-2019-10632 affects the Zyxel NAS 326 File Browser component (versions 5.21 and earlier). The vulnerability is a directory traversal that lets a lower-privileged user change the location of another user’s files. There are no exploit details provided in the connected documents, and remediation ...
CVE-2019-10632: Improper Limitation of a Pathname to a Restricted Directory
A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files...
Zyxel NAS 326 Directory Traversal Vulnerability
The Zyxel NAS 326 is a two-drive personal cloud storage device from Zyxel. A directory traversal vulnerability exists in the File Browser component of the Zyxel NAS 326 5.21 and earlier versions. A low-privileged user can exploit this vulnerability to change the location of any other user's files...
PT-2019-11951
Name of the Vulnerable Software and Affected Versions Zyxel NAS 326 versions 5.21 and below Description A directory traversal issue in the file browser component allows a lower privileged user to change the location of any other user's files. Recommendations For Zyxel NAS 326 versions 5.21 and...
Node.js third-party modules: [file-browser] Inadequate Output Encoding and Escaping
I would like to report stored xss in file-browser module It allows an attacker to embed malicious js code as filenames,which get executed once browsed to the file over the web browser Module module name: file-browser version: 0.0.5 npm page: https://www.npmjs.com/package/file-browser Module...
Roxy Fileman 1.4.5 - Unrestricted File Upload Directory Traversal
Roxy Fileman 1.4.5 - Unrestricted File Upload Directory Traversal ====================================================================== Exploit Title:: Multiple Vulnerabilities Software: Roxy Fileman Version: 1.4.5 Vendor Homepage: http://www.roxyfileman.com/ Software Link:...
Roxy Fileman 1.4.5 File Upload / Directory Traversal
====================================================================== Exploit Title:: Multiple Vulnerabilities Software: Roxy Fileman Version: 1.4.5 Vendor Homepage: http://www.roxyfileman.com/ Software Link: http://www.roxyfileman.com/download.php?f=1.4.5-php CVE number: CVE-2018-20525,...
Fedora 28 : ckeditor (2018-107dbc8cf4)
4.9.2 https://ckeditor.com/cke4/release/CKEditor-4.9.2 Security Updates - Fixed XSS vulnerability in the Enhanced Image image2 plugin reported by Kyaw Min Thein. - Issue summary: It was possible to execute XSS inside CKEditor using the tag and specially crafted HTML. Please note that the default...
BigTree CMS cross-site scripting vulnerability (CNVD-2018-21319)
Fastspot BigTree is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A cross-site scripting vulnerability exists in /admin/ajax/file-browser/upload/ in Fastspot BigTree version 4.2.23. A remote attacker can exploit this vulnerability to inject...
CVE-2018-18308
In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ aka the image upload area...
CVE-2018-18308: Improper Neutralization of Input During Web Page Generation
In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ aka the image upload area...
PT-2018-14398
Name of the Vulnerable Software and Affected Versions BigTree version 4.2.23 Description A Stored XSS issue has been found in the image upload area, specifically at the "/admin/ajax/file-browser/upload/" API endpoint. Recommendations For BigTree version 4.2.23, update to a newer version that...
HScripts PHP File Browser Script Path Traversal Vulnerability
HScripts PHP File Browser Script is a file browser script that is used to display, search and browse folders. A directory traversal vulnerability exists in the index.php file in version 1.0 of HScripts PHP File Browser Script. The vulnerability can be exploited to read all files with known names...