54 matches found
CVE-2025-28367
mojoPortal =2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey...
CVE-2025-28367
mojoPortal =2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey...
CVE-2025-28367
mojoPortal =2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey...
CVE-2025-28367
mojoPortal =2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey...
CVE-2025-28367
mojoPortal
Vulnerability fixed in Gladinet CentreStack
Gladinet has fixed a vulnerability in CentreStack Versions up to 16.1.10296.56315. The vulnerability is in the way hard-coded machineKeys and cryptographic keys are used, resulting in a serious deserialization vulnerability. The vulnerability allows a malicious party to generate rogue ViewState...
CVE-2025-30406
Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...
CVE-2025-30406
Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...
CVE-2025-30406
Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...
CVE-2025-30406
Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...
Gladinet CentreStack 安全漏洞
Gladinet CentreStack is a premier mobile access and secure sharing solution from Gladinet USA. provides self-hosted cloud storage. A security vulnerability exists in Gladinet CentreStack that stems from hardcoding a machineKey resulting in a deserialization vulnerability that could lead to remote...
CVE-2025-30406
Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...
PT-2025-14795
Name of the Vulnerable Software and Affected Versions Gladinet CentreStack versions prior to 16.4.10315.56368 Gladinet Triofox versions prior to 16.4.10317.56372 Description Gladinet CentreStack and Triofox are affected by a deserialization vulnerability due to the use of a hardcoded machineKey i...
CVE-2025-30406
Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal’s hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...
CVE-2025-30406
Summary (mode C): Gladinet CentreStack and Triofox are affected by a hard-coded machineKey in web.config that enables ViewState deserialization attacks (CVE-2025-30406). The flaw allows an unauthenticated attacker to forge ViewState payloads, leading to remote code execution and has been exploite...
CVE-2021-39392
The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded the same for all customers' installations in web.config, and can be used to send serialized ASP code...
CVE-2021-39392
The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded the same for all customers' installations in web.config, and can be used to send serialized ASP code...
Hardcoded credentials
The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded the same for all customers' installations in web.config, and can be used to send serialized ASP code...
CVE-2021-39392
The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded the same for all customers' installations in web.config, and can be used to send serialized ASP code...
The vulnerability of the Telerik.Web.UI.dll library of the Telerik UI software for ASP.NET AJAX and the Sitefinity web content management system allows a attacker to exploit the encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or MachineKey).
The vulnerability of the Telerik.Web.UI.dll library of the Telerik UI software for ASP.NET AJAX and the Sitefinity web content management system is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to disclose encryption keys...