CVE-2019-17189

totemodata 3.0.0b936 has XSS via a folder name...

Persistence – Time Providers

Windows operating systems are utilizing the time provider architecture in order to obtain accurate time stamps from other network devices or clients in the network. Time providers are implemented in the form of a DLL file which resides in System32 folder. The service W32Time initiates during the...

PT-2019-14993

Name of the Vulnerable Software and Affected Versions totemodata version 3.0.0 b936 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs via a folder name, allowing potential exploitation. Recommendations For totemodata version 3.0.0 b936, avoid using user-supplied...

CVE-2019-17189: Improper Neutralization of Input During Web Page Generation

totemodata 3.0.0b936 has XSS via a folder name...

ZipperDown Vulnerability

react-native-code-push is susceptible to zipperdown vulnerability. The vulnerability exists because it does not validate the folder of the zip file before performing the extraction of files and directly writing the content to arbitrary folder...

CVE-2019-16913

PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILESX86%\PCProtect with very weak folder permissions, granting any user full permission "Everyone: F" to the contents of the directory and its subfolders. In addition, the program installs a service called SecurityService that runs as...

Default credentials

PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILESX86%\PCProtect with very weak folder permissions, granting any user full permission "Everyone: F" to the contents of the directory and its subfolders. In addition, the program installs a service called SecurityService that runs as...

CVE-2019-16913

PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILESX86%\PCProtect with very weak folder permissions, granting any user full permission "Everyone: F" to the contents of the directory and its subfolders. In addition, the program installs a service called SecurityService that runs as...

CVE-2019-16913

PC Protect Antivirus (v4.14.31) is installed to %PROGRAMFILES(X86)%\PCProtect with overly permissive folder ACLs (Everyone: (F)). The component also creates a service (SecurityService) that runs as LocalSystem. This combination enables privilege escalation to NT AUTHORITY\SYSTEM by replacing the ...

CVE-2019-16913: Incorrect Default Permissions

PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILESX86%\PCProtect with very weak folder permissions, granting any user full permission "Everyone: F" to the contents of the directory and its subfolders. In addition, the program installs a service called SecurityService that runs as...

PT-2019-14863

Name of the Vulnerable Software and Affected Versions PC Protect Antivirus version 4.14.31 Description The issue concerns weak folder permissions in the default installation directory of PC Protect Antivirus, allowing any user to modify the contents of the directory and its subfolders...

CVE-2019-17203

TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder...

CVE-2019-17203

TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder...

CVE-2008-1291

ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder...

CVE-2007-6688

Unspecified vulnerability in the Installation application in Menalto Gallery before 2.2.4 has unknown impact and attack vectors related to "web-accessibility protection of the storage folder."...

CVE-2019-17040

contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled...

CVE-2019-11751

Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links in a chat application. This can be used to write a log file to an arbitrary location such as the Windows 'Startup' folder. Note: this issue...

Cross site scripting

TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin. The crafted password is exploitable when viewing the change history of the item or tapping on the item...

CVE-2019-16904: Improper Neutralization of Input During Web Page Generation

TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin. The crafted password is exploitable when viewing the change history of the item or tapping on the item...

CVE-2019-14252

An issue was discovered in the secure portal in Publisure 2.1.2. Once successfully authenticated as an administrator, one is able to inject arbitrary PHP code by using the adminCons.php form. The code is then stored in the E:\PUBLISURE\webservice\webpages\AdminDir\Templates\ folder even if remove...