11 matches found
EUVD-2019-7468
Malware in sbrugna...
c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation
A flaw was found in c-ares. This issue occurs when cross-compiling c-ares and using the autotools build system, CARESRANDOMFILE will not be set, as seen when cross-compiling aarch64 android. As a result, it will downgrade to rand, which could allow an attacker to utilize the lack of entropy by no...
CVE-2021-45746
A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackageController.java...
PT-2022-12387
Name of the Vulnerable Software and Affected Versions WeBankPartners wecube-platform version 3.2.1 Description A Directory Traversal issue exists via the file variable in PluginPackageController.java. Recommendations For WeBankPartners wecube-platform version 3.2.1, consider restricting access to...
CVE-2021-45746: Improper Limitation of a Pathname to a Restricted Directory
A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackageController.java...
CVE-2019-16991
In FusionPBX up to v4.5.7, the file app\edit\filedelete.php uses an unsanitized "file" variable coming from the URL, which is reflected in HTML, leading to XSS...
CVE-2019-16991
In FusionPBX up to v4.5.7, the file app\edit\filedelete.php uses an unsanitized "file" variable coming from the URL, which is reflected in HTML, leading to XSS...
CVE-2019-16990
In FusionPBX up to v4.5.7, the file app/musiconhold/musiconhold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname base64 encoded and allows a download of it...
CVE-2019-16991: Improper Neutralization of Input During Web Page Generation
In FusionPBX up to v4.5.7, the file app\edit\filedelete.php uses an unsanitized "file" variable coming from the URL, which is reflected in HTML, leading to XSS...
PT-2019-14911 · Fusionpbx · Fusionpbx
Name of the Vulnerable Software and Affected Versions: FusionPBX versions up to 4.5.7 Description: The issue concerns the use of an unsanitized file variable in the music on hold.php file, which allows the download of any pathname, provided it is base64 encoded, when coming from the URL...