CVE-2020-8986: Improper Check for Unusual or Exceptional Conditions

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests...

PT-2020-20409

Name of the Vulnerable Software and Affected Versions ZendTo versions prior to 5.22-2 Beta Description The issue is related to the lib/NSSDropbox.php file in ZendTo, where it failed to properly check for equality when validating the session cookie. This allows an attacker to gain administrative...

CVE-2020-10879

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped...

CVE-2020-10879

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped...

CVE-2020-10879

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped...

PT-2020-4763

Name of the Vulnerable Software and Affected Versions: rConfig versions prior to 3.9.5 Description: The issue is related to a lack of proper neutralization of special elements used in operating system commands. This can be exploited by a remote attacker using a specially crafted GET request,...

CVE-2020-10879: Improper Neutralization of Special Elements used in an OS Command

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped...

WS-2020-0355

nDPI in version 3.2 is vulnerable to Use-of-uninitialized-value , related to src/lib/protocols/tls.c...

CVE-2020-7604

pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...

CVE-2020-7604

pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...

CVE-2020-7604

pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...

PT-2020-1959

Name of the Vulnerable Software and Affected Versions pulverizr versions through 0.7.0 Description The issue exists due to a lack of sanitization of special elements in the Pulverizr package. This allows a remote attacker to execute arbitrary commands in the target system by creating a file with...

CVE-2020-7604: Improper Neutralization of Special Elements used in an OS Command

pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...

Directory traversal

An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file into the lib directory, because of a wfuincludelib call...

Command Injection

Overview pulverizr is a to smash your images down to size. Affected versions of this package are vulnerable to Command Injection. Within lib/job.js, the variable filename can be controlled by the attacker. This function uses the variable filename to construct the argument of the exec call without...

PT-2020-12206

Name of the Vulnerable Software and Affected Versions File Upload plugin versions prior to 4.13.0 for WordPress Description The issue allows for directory traversal, potentially leading to remote code execution. This can be achieved by uploading a specially crafted txt file into the lib directory...

CVE-2020-10235

An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of backupExistingDatabase in install/lib/class.FroxlorInstall.php...

CVE-2020-10237

An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time,...

CVE-2020-10236

An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of createUserdataConf in...

PT-2020-11991

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 0.10.14 Description An issue was discovered that allows remote attackers with access to the installation routine to execute arbitrary code. This is due to the database configuration options being passed unescaped to...