CVE-2020-24386

An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages and path disclosure. Mitigation To mitigate this flaw, ensure that imaphibernatetimeout is...

phpMyAdmin 4.0.0 < 4.0.10.17 / 4.4.0 < 4.4.15.8 / 4.6.0 < 4.6.4 Multiple Vulnerabilities

"According to its self-reported version, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.17, 4.4.x prior to 4.4.15.8, or 4.6.x prior to 4.6.4. It is, therefore, affected by multiple vulnerabilities. - An issue was discovered in cookie encryption in phpMyAdmin...

CVE-2020-15794

CVE-2020-15794 affects Siemens Desigo Insight (All versions). The web application may reveal absolute file system paths in error messages, enabling an authenticated attacker to retrieve additional information about the host system (information disclosure). Mitigations documented by vendors includ...

ElkarBackup Path Traversal Vulnerability

ElkarBackup is a free open source backup solution based on RSync/RSnapshot. ElkarBackup 1.3.3 suffers from a sensitive source code path disclosure vulnerability. An attacker can exploit this vulnerability to view the path to the jobs/sort source code, which can be used to identify the code...

CVE-2020-24925

A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3. An attacker is able to view the path of the source code jobs/sort where entire source code path is displayed in the browser itself helping the attacker identify the code structure...

CVE-2020-24925

A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3. An attacker is able to view the path of the source code jobs/sort where entire source code path is displayed in the browser itself helping the attacker identify the code structure...

CVE-2020-24925

Summary: CVE-2020-24925 affects ElkarBackup v1.3.3 and exposes a sensitive source code path disclosure. What is affected: ElkarBackup, component path disclosure in the web UI, specifically the jobs/sort path, which reveals the full source code path: /app/elkarbackup/src/Binovo/ElkarBackupBundle/C...

CS Money: Internal Path Disclosure

Hello Team, I would like to report internal path disclosure in response. I was trying for Stored XSS but got no luck in that process. I observed the responses, one of the responses showing file path with 500 Internal Server Error. Steps To Reproduce: 1. Go to cs.money and sign in through steam...

PT-2020-6941 · Dovecot +7 · Dovecot +7

Name of the Vulnerable Software and Affected Versions: Dovecot versions prior to 2.3.13 Description: The issue is related to the improper neutralization of control and meta characters in the Dovecot mail server, allowing a remote attacker to access and compromise confidential data. By using IMAP...

CVE-2020-15596

The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Disclosure attacks via a "fake" DLL file...

Path traversal

The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Disclosure attacks via a "fake" DLL file...

CVE-2020-15596

The CVE-2020-15596 issue affects the ALPS ALPINE Touchpad Driver (before 8.2206.1717.634) used on Dell/HP/Lenovo systems. Root cause: a DLL search/path vulnerability that can be exploited via a malicious or fake DLL to disclose paths or escalate privileges. Public documents cite potential local i...

CVE-2020-15596

The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Disclosure attacks via a "fake" DLL file...

Dropcontact: Unrestricted File Upload on https://app.dropcontact.io/app/upload/

hi team, I found Unrestricted File Upload Vulnerabilities on https://app.dropcontact.io/app/upload/. Steps To Reproduce: 1. Create an account in https://app.dropcontact.io/app/ 1. go to https://app.dropcontact.io/app/upload/ 1. try to upload html file , you will see message only : .csv, .txt, .xl...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Path Disclosure (CVE-2019-4745)

Summary IBM Maximo Asset Management could allow a remote attacker to disclose sensitive information to an authenticated user due to disclosing path information in the URL. Vulnerability Details CVEID: CVE-2019-4745 DESCRIPTION: IBM Maximo Asset Management could allow a remote attacker to disclose...

Nextcloud: Full path disclosure vulnerability via Upload .htaccess file

Hello Security team, i foud Full path disclosure vulnerability via Upload .htaccess file see POC video. Thankz Impact Sensitive File/Folder Information...

CVE-2020-5880

Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server...

CVE-2020-5880

Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server...

CVE-2017-18687

Technical details (affected product/version, root cause, impact, or fixes) are not publicly provided in the connected documents. Monitor for updates; current sources summarize the issue but do not offer actionable specifics.

jetty: error path information disclosure

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches...