Design/Logic Flaw

Umbraco Cloud 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Packages functionality...

Design/Logic Flaw

Umbraco CMS 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Package functionality...

CVE-2020-9472

Umbraco CMS 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Package functionality...

CVE-2020-9471

Umbraco Cloud 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Packages functionality...

CVE-2020-9472

Umbraco CMS 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Package functionality...

CVE-2020-9472

CVE-2020-9472 affects Umbraco CMS 8.5.3. The authenticated user can upload files via the Install Package functionality, which can lead to Remote Code Execution. The vulnerability is evidenced by the CVE description and corroborated across multiple sources in the connected documents (e.g., GHSA/OS...

CVE-2020-9472

Umbraco CMS 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Package functionality...

CVE-2020-9471

Umbraco Cloud 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Packages functionality...

CVE-2020-9471

Umbraco Cloud 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Packages functionality...

CVE-2020-9472: Unrestricted Upload of File with Dangerous Type

Umbraco CMS 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Package functionality...

CVE-2020-9471: Unrestricted Upload of File with Dangerous Type

Umbraco Cloud 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Packages functionality...

PT-2020-20683

Name of the Vulnerable Software and Affected Versions Umbraco Cloud version 8.5.3 Description The issue allows an authenticated file upload, which can lead to Remote Code Execution, via the Install Packages functionality. Recommendations For Umbraco Cloud version 8.5.3, update to a version that...

PT-2020-20684

Name of the Vulnerable Software and Affected Versions Umbraco CMS version 8.5.3 Umbraco Cloud version 8.5.3 Description The issue allows an authenticated file upload, which can lead to Remote Code Execution, via the Install Package or Install Packages functionality. Recommendations For Umbraco CM...

Install Go tools from modules with brew-gomod

As of Go 1.14, modules are ready for production. Compared to GOPATH, they make it much easier to keep workspaces clean by managing dependencies out of sight, and by letting you clone projects anywhere. However, there is no good way to simply install a Go binary from source, yet. The core reason f...

rConfig 3.9 - (searchColumn) SQL Injection Exploit

Exploit for php platform in category web applications Exploit Title: rConfig 3.9 - 'searchColumn' SQL Injection Exploit Author: vikingfr CVE-2020-10220 Exploit link : https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfigCVE-2020-10220.py Vendor Homepage: https://rconfig.com/ see also :...

Wing FTP Server 6.2.3 Cross Site Request Forgery Vulnerability

Exploit Title: Wing FTP Server 6.2.3 - Privilege Escalation Exploit Author: Dhiraj Mishra Vendor Homepage: https://www.wftpserver.com Version: v6.2.6 Tested on: Windows 10 Summary: An authenticated CSRF exists in web client and web administration of Wing FTP v6.2.6, a crafted HTML page could dele...

CVE-2020-10235

An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of backupExistingDatabase in install/lib/class.FroxlorInstall.php...

CVE-2020-10237

An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time,...

CVE-2020-10236

An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of createUserdataConf in...

CVE-2020-10237: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time,...