Coditor <= 1.1 - Arbitrary File Edition, Deletion and Internal Directory Listing in wp-content

The coditorprocessajax AJAX call is missing any CSRF and authorisation checks, allowing low privilege users subscriber+ to read and edit any files in the wp-content folder, as well as list its content. PoC The PoC will be displayed once the issue has been remediated...

WordPress JobMonster premium theme <= 4.6.6 - Directory Listing in Upload Folder vulnerability

Directory Listing in Upload Folder vulnerability found by Daniel Ruf in WordPress JobMonster premium theme versions = 4.6.6. Solution Update the WordPress JobMonster premium theme to the latest available version at least 4.6.6.1...

JobMonster < 4.6.6.1 - Directory Listing in Upload Folder

The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the we...

SCADAPack Remote Connect Authorization Issues Vulnerability

SCADAPack is a Schneider-electric intelligent field controller that combines the monitoring and communication capabilities of a Remote Terminal Unit RTU with the processing and data logging capabilities of a Programmable Logic Controller PLC to provide superior functionality for remote processes...

CVE-2020-7531: Improper Access Control

A CWE-284 Improper Access Control vulnerability exists in SCADAPack 7x Remote Connect V3.6.3.574 and prior which allows an attacker to place executables in a specific folder and run code whenever RemoteConnect is executed by the user...

CVE-2020-7529: Improper Limitation of a Pathname to a Restricted Directory

A CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Transversal' vulnerability exists in SCADAPack 7x Remote Connect V3.6.3.574 and prior which allows an attacker to place content in any unprotected folder on the target system using a crafted .RCZ file...

McAfee MVISION Endpoint Access Control Error Vulnerability

McAfee MVISION Endpoint is a set of endpoint security protection software from the U.S. company McAfee McAfee. The software provides enhanced threat detection and correction for Windows systems. Access Control Error Vulnerability in Windows McAfee MVISION Endpoint before version 20.9. The...

McAfee Agent Elevation of Privilege Vulnerability

McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator antivirus management platform and managed products. An elevation of privilege vulnerability exists in McAfee Agent. The vulnerability stems from an incorrect programmat...

CVE-2014-10401

An issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the fdir attribute...

PT-2020-5433

Name of the Vulnerable Software and Affected Versions eDocLib affected versions not specified Description The issue exists due to inadequate protection of the web page structure in the eDocLib platform for storing and processing corporate data. An attacker can exploit this issue to execute...

CVE-2020-7324

Improper Access Control vulnerability in McAfee MVISION Endpoint prior to 20.9 Update allows local users to bypass security mechanisms and deny access to the SYSTEM folder via incorrectly applied permissions...

CVE-2020-7324 Improper Access Control vulnerability in MVISION Endpoint

Improper Access Control vulnerability in McAfee MVISION Endpoint prior to 20.9 Update allows local users to bypass security mechanisms and deny access to the SYSTEM folder via incorrectly applied permissions...

CVE-2020-7324: Improper Privilege Management

Improper Access Control vulnerability in McAfee MVISION Endpoint prior to 20.9 Update allows local users to bypass security mechanisms and deny access to the SYSTEM folder via incorrectly applied permissions...

PT-2020-19553

Name of the Vulnerable Software and Affected Versions McAfee MVISION Endpoint versions prior to 20.9 Update Description The issue is related to an Improper Access Control vulnerability. It allows local users to bypass security mechanisms and deny access to the SYSTEM folder due to incorrectly...

Work Folder Service Privilege Escalation

The vulnerability of the Work Folder Service service in Windows operating systems is related to improper handling of file operations. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...

CVE-2020-7324

Improper Access Control vulnerability in McAfee MVISION Endpoint prior to 20.9 Update allows local users to bypass security mechanisms and deny access to the SYSTEM folder via incorrectly applied permissions...

BarracudaDrive v6.5 - Insecure Folder Permissions Vulnerability

Exploit Title: BarracudaDrive v6.5 - Insecure Folder Permissions Exploit Author: Bobby Cooke boku & Adeeb Shah @hyd3sec Vendor Homepage: https://barracudaserver.com/ Software Link: https://download.cnet.com/BarracudaDrive/3001-185064-10723210.html Version: v6.5 Tested On: Windows 10 Pro CVSS Base...

GHSA-G9WF-393Q-4W38 Malicious Package in only-test-not-install

All versions of only-test-not-install contain malicious code. The package deletes the folder /test from the system as a postinstall script. Recommendation Remove the package from your environment. There are no further signs of compromise...

CVE-2019-10679

Thomson Reuters Eikon 4.0.42144 allows all local users to modify the service executable file because of weak %PROGRAMFILESX86%\Thomson Reuters\Eikon permissions...

PT-2020-21304

Name of the Vulnerable Software and Affected Versions only-test-not-install versions affected versions not specified Description The issue concerns malicious code within the package that deletes the folder /test from the system as a postinstall script. There are no further signs of compromise...