CVE-2018-7482

The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demonstrated by a view=media&task=connector&cmd=file&target=l1../configuration.php&download=1 request. The specific pathname ../configuration.php should b...

CVE-2018-7482

The CVE-2018-7482 vulnerability affects the Joomla! K2 component version 2.8.0, where an Incorrect Access Control allows directory traversal to download arbitrary files via a crafted request (view=media&task=connector&cmd=file&target=l1_../configuration.php&download=1). The base path l1_.. sugges...

CVE-2018-7482

The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demonstrated by a view=media&task=connector&cmd=file&target=l1../configuration.php&download=1 request. The specific pathname ../configuration.php should b...

Joomla! Component K2 2.8.0 - Arbitrary File Download

Joomla! Component K2 2.8.0 - Arbitrary File Download. CVE-2018-7482. Webapps exploit for PHP platform Exploit Title: Joomla! Component K2 2.8.0 - Arbitrary File Download Dork: N/A Date: 26.02.2018 Vendor Homepage: http://www.joomlaworks.net/ Software Link:...

Joomla! K2 2.8.0 Arbitrary File Download

Exploit Title: Joomla! Component K2 2.8.0 - Arbitrary File Download Dork: N/A Date: 26.02.2018 Vendor Homepage: http://www.joomlaworks.net/ Software Link: https://extensions.joomla.org/extensions/extension/authoring-a-content/content-construction/k2/ Software Download:...

Joomla K2 2.8.0 Component - Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component K2 2.8.0 - Arbitrary File Download Dork: N/A Date: 26.02.2018 Vendor Homepage: http://www.joomlaworks.net/ Software Link:...

k2-y.com XSS vulnerability

Open Bug Bounty ID: OBB-465310 Description| Value ---|--- Affected Website:| k2-y.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

Joomla YJ Filter For K2 1.0.5 SQL Injection Vulnerability

Exploit for php platform in category web applications Title: Joomla YJ Filter for K2 1.0.5 Module SQL Injection Credit: Bilal KARDADOU Vendor: http://www.youjoomla.com URL: https://extensions.joomla.org/extensions/extension/extension-specific/k2-extensions/yj-filter-for-k2/ Product: 'Joomla YJ...

Joomla YouBumpit 2.0 SQL Injection

Title: Joomla YouBumpit Extension 2.0 SQL Injection Credit: Bilal KARDADOU Vendor: http://www.youjoomla.com URL: http://extensions.youjoomla.info/youbumpit-extension.html Product: 'Joomla YouBumpit Extension 2.0' Extension type: Plugin Compatibility: J1.5 J1.7 J2.5 J3.X Google Dork:...

Joomla YJ Filter For K2 1.0.5 SQL Injection

Title: Joomla YJ Filter for K2 1.0.5 Module SQL Injection Credit: Bilal KARDADOU Vendor: http://www.youjoomla.com URL: https://extensions.joomla.org/extensions/extension/extension-specific/k2-extensions/yj-filter-for-k2/ Product: 'Joomla YJ Filter for K2 version 1.0.5' Extension type: Module...

PHICOMM K2 (PSG1218) Input Validation Vulnerability

The PHICOMM K2 PSG1218 is a wireless router product from the Chinese company PHICOMM. An input validation vulnerability exists in PHICOMM K2 PSG1218 versions 22.5.11.5 and earlier. A remote attacker can exploit this vulnerability by sending a request to an ASP script to execute code...

Command Execution Vulnerability in Fusion K2 Wireless Router of Shanghai Fusion Data Communication Technology Co.

The Fusion K2 Wireless Router is a wireless router for home use. A command execution vulnerability exists in the Fusion K2 Wireless Router from Shanghai Fusion Data Communication Technology Co. The vulnerability is due to the timeRebootEnablestatus and timeRebootrange parameters not filtering...

epaper.dailyk2.com XSS vulnerability

Open Bug Bounty ID: OBB-271258 Description| Value ---|--- Affected Website:| epaper.dailyk2.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Chea...

Fusion K2 Wireless Router Has Logic Flaw Vulnerability

Fusion Route Android app is an app for managing Fusion routers. A logic flaw vulnerability exists in the Fusion K2 wireless router. An attacker can exploit this vulnerability to obtain the router administrator username and password in the unlogged-in state and then take control of the router...

Fusion K2 wireless router suffers from an override access vulnerability

The Fusion K2 PSG1218 router is a new generation of wireless routers for entry-level users. The Fusion K2 wireless router is vulnerable to an override access vulnerability. An attacker can use the vulnerability to obtain the details of all end devices in the LAN without logging in, and also perfo...

Remote code execution

PHICOMM K2PSG1218 devices V22.5.11.5 and earlier allow unauthenticated remote code execution via a request to an unspecified ASP script; alternatively, the attacker can leverage unauthenticated access to this script to trigger a reboot via an ifType=reboot action...

CVE-2017-11495

PHICOMM K2PSG1218 devices V22.5.11.5 and earlier allow unauthenticated remote code execution via a request to an unspecified ASP script; alternatively, the attacker can leverage unauthenticated access to this script to trigger a reboot via an ifType=reboot action...

CVE-2017-11495

PHICOMM K2PSG1218 devices V22.5.11.5 and earlier allow unauthenticated remote code execution via a request to an unspecified ASP script; alternatively, the attacker can leverage unauthenticated access to this script to trigger a reboot via an ifType=reboot action...

CVE-2017-11495

CVE-2017-11495 affects PHICOMM K2 (PSG1218) devices with firmware versions 22.5.11.5 and earlier. Multiple connected sources confirm an unauthenticated remote code execution vulnerability accessible via an unspecified ASP script, with a secondary exploit path where unauthenticated access to that ...

CVE-2017-11495

PHICOMM K2PSG1218 devices V22.5.11.5 and earlier allow unauthenticated remote code execution via a request to an unspecified ASP script; alternatively, the attacker can leverage unauthenticated access to this script to trigger a reboot via an ifType=reboot action...