CVE-2019-18384

CVE-2019-18384 affects TerraMaster FS-210 devices (4.0.19). An authenticated remote non-administrative user can read unauthorized shared files, as shown by the substring filename=public %25252Fadmin_OnlyRead.txt. The connected RH Red Hat and CNVD/CVE records corroborate an information disclosure ...

CVE-2019-18384

An issue was discovered on TerraMaster FS-210 4.0.19 devices. An authenticated remote non-administrative user can read unauthorized shared files, as demonstrated by the filename=public%25252FadminOnlyRead.txt substring...

CVE-2019-18385

An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring...

CVE-2019-18385

The CVE relates to TerraMaster FS-210 devices running 4.0.19 where an unauthenticated attacker can download log files through the include/makecvs.php?Event= substring. This is an information-disclosure vulnerability affecting the NAS’s web-accessible log files; the root cause is an insecure endpo...

CVE-2019-18385: Insertion of Sensitive Information into Log File

An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring...

PT-2019-15390

Name of the Vulnerable Software and Affected Versions TerraMaster FS-210 version 4.0.19 Description An issue allows an authenticated remote non-administrative user to read unauthorized shared files. This is demonstrated by using the filename=public%25252Fadmin OnlyRead.txt substring...

PT-2019-15389

Name of the Vulnerable Software and Affected Versions TerraMaster FS-210 version 4.0.19 Description An issue allows remote download of backup files, specifically terramaster TNAS-00E43A config backup.bin, without permission. Recommendations For TerraMaster FS-210 version 4.0.19, restrict access t...

PT-2019-15391

Name of the Vulnerable Software and Affected Versions TerraMaster FS-210 version 4.0.19 Description An issue allows an unauthenticated attacker to download log files. This can be achieved via the "include/makecvs.php?Event=" substring, which is likely an API endpoint. The Event variable seems to ...

CVE-2019-18383: Missing Authorization

An issue was discovered on TerraMaster FS-210 4.0.19 devices. One can download backup files remotely from terramasterTNAS-00E43Aconfigbackup.bin without permission...

CVE-2019-18384: Undefined Security Weakness

An issue was discovered on TerraMaster FS-210 4.0.19 devices. An authenticated remote non-administrative user can read unauthorized shared files, as demonstrated by the filename=public%25252FadminOnlyRead.txt substring...

kernel security and bug fix update

3.10.0-1062.4.1.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 3.10.0-1062.4.1 - vhost vhost: make sure lognum innum Eugenio Perez 1750879 1750880...

CVE-2016-10951

The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter...

Sql injection

The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter...

CVE-2016-10951

CVE-2016-10951 affects the WordPress plugin fs-shopping-cart (version 2.07.02). The vulnerability is an SQL injection via the pid parameter, demonstrated by PoCs showing unescaped input in the admin context (e.g., UNION SELECT payloads). Connected documents corroborate an authenticated SQL inject...

CVE-2016-10951

The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter...

PT-2019-7744

Name of the Vulnerable Software and Affected Versions fs-shopping-cart plugin version 2.07.02 for WordPress Description The issue is related to SQL injection via the pid parameter. This allows for potential exploitation. Recommendations For fs-shopping-cart plugin version 2.07.02, consider...

CVE-2016-10951: Improper Neutralization of Special Elements used in an SQL Command

The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter...

PT-2019-4255

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 5.3.12 Description The issue is related to a NULL pointer dereference in the btrfs root node function, located in fs/btrfs/ctree.c. This can be triggered because rcu dereferenceroot-node can be zero, leading to a...

UBUNTU-CVE-2019-9444

In the Android kernel in sync debug fs driver there is a kernel pointer leak due to the usage of printf with %p. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation...

CVE-2019-9444

In the Android kernel in sync debug fs driver there is a kernel pointer leak due to the usage of printf with %p. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation...