Directory Traversal

Overview marked-tree is a markdown viewer for viewing markdown within a development environment. Affected versions of this package are vulnerable to Directory Traversal. There is no path sanitization in the path provided at fs.readFile in index.js. PoC by JHU System Security Lab 1. Start the serv...

Vxscan

This is a Python script for a comprehensive scanning tool called Vxscan. The tool is designed to perform various types of scans, including sensitive file detection, WAF/CDN identification, port scanning, fingerprint/service identification, operating system identification, weak password detection,...

NukeViet VMS 4.4.00 - Cross-Site Request Forgery (Change Admin Password)

Exploit Title: NukeViet VMS 4.4.00 - Cross-Site Request Forgery Change Admin Password Date: 2020-05-18 Exploit Author: JEBARAJ Vendor Homepage: https://nukeviet.vn/ Software Link: https://github.com/nukeviet/nukeviet/releases/download/4.4.00/nukeviet4.4.00setup.zip Version: 4.4.00 Tested on:...

GHSA-PX9H-X66R-8MPC path traversal in Jooby

Impact Access to sensitive information available from classpath. Patches Patched version: 1.6.7 and 2.8.2 Commit 1.x: https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009 Commit 2.x:...

Exploit for Path Traversal in Zohocorp Manageengine_Opmanager

CVE-2020-12116 Proof of concept code to exploit CVE-2020-1211...

Blaauw Remote Kiln Control Information Disclosure Vulnerability (CNVD-2020-28485)

The Blaauw Remote Kiln Control is an automated ceramic kiln controller from Blaauw in the Netherlands. An information disclosure vulnerability exists in Blaauw Remote Kiln Control. An attacker could exploit the vulnerability to enumerate sensitive file names and locations including source code...

HiveJack - This Tool Can Be Used During Internal Penetration Testing To Dump Windows Credentials From An Already-Compromised Host

This tool can be used during internal penetration testing to dump Windows credentials from an already-compromised host. It allows one to dump SYSTEM, SECURITY and SAM registry hives and once copied to the attacker machines provides an option to delete these files to clear the trace. Often, this i...

BMC Software Control-M/Agent Command Execution Vulnerability

BMC Software Control-M is a workload automation solution from BMC Software, USA. The product supports customizing, scheduling, managing and monitoring workflows, etc. BMC Software Control-M/Agent is an agent program for BMC Software Control-M. A security vulnerability exists in BMC Software...

CVE-2020-3187 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted...

CVE-2020-3187

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted...

CVE-2020-12447

A Local File Inclusion LFI issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal, as demonstrated by reading /etc/shadow...

CVE-2020-12447

A Local File Inclusion LFI issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal, as demonstrated by reading /etc/shadow...

Directory traversal

A Local File Inclusion LFI issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal, as demonstrated by reading /etc/shadow...

CVE-2020-12447

A Local File Inclusion LFI issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal, as demonstrated by reading /etc/shadow...

CVE-2020-12112

BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion...

Design/Logic Flaw

BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion...

CVE-2020-12112

BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion...

CVE-2020-12112

BigBlueButton had an LFI/vulnerability in versions before 2.2.5 (CVE-2020-12112). Connected sources also describe a related issue (CVE-2020-12443) where case-insensitive handling of presFilename/presfilename enables directory traversal to bigbluebutton.properties, enabling reading of arbitrary fi...

PT-2020-13043 · Bigbluebutton · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.2.5 Description: The issue allows remote attackers to obtain sensitive files via Local File Inclusion. Recommendations: For versions prior to 2.2.5, update to version 2.2.5 or later to resolve the issue...

Rainy novel cms 1.2.2 background template management function there are directory traversal vulnerabilities

Wild Rain Fiction cms hereinafter referred to as KYXSCMS provides a lightweight fiction website solution based on ThinkPHP 5.1+MySQL. A directory traversal vulnerability exists in the backend template management feature of Drizzle Novel cms 1.2.2. Attackers can use the vulnerability to view file...