Path Traversal in bookstackapp/bookstack

Description A path traversal vulnerability in BookStacks export function allows for the exposure of sensitive files in local or localsecure Laravel filesystems. Proof of Concept 1: Write the following in a new page: 2: Export in contained HTML to find the .htaccess file base64 encoded 3: If the...

Siemens Teamcenter

1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Teamcenter Vulnerability: Privilege Defined with Unsafe Actions, Authorization Bypass Through User-Controlled Key, Improper Restriction of XML External Entity Reference 2. RISK...

CVE-2021-33543

Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. This can lead to manipulation of the device and denial of service...

CVE-2021-33543

Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. This can lead to manipulation of the device and denial of service...

CVE-2021-33543

Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. This can lead to manipulation of the device and denial of service...

Authentication flaw

Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. This can lead to manipulation of the device and denial of service...

CVE-2021-33543

The CVE-2021-33543 entry describes an authentication-by-default flaw in UDP Technology firmware used by Geutebrück G-Cam E2 and G-Code devices (and OEM variants). A missing authentication for critical functions allows unauthenticated remote access to sensitive files, enabling manipulation of devi...

CVE-2021-33543 UDP Technology/Geutebrück camera devices: Authentication Bypass

Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. This can lead to manipulation of the device and denial of service...

PT-2021-20190 · Geutebrück +1 · Geutebrück Camera Devices +1

Name of the Vulnerable Software and Affected Versions: UDP Technology camera devices affected versions not specified Geutebrück camera devices affected versions not specified Description: The issue allows unauthenticated remote access to sensitive files due to default user authentication settings...

Path Traversal in lampnick/doctron

✍️ Description doctron is a golang tool that helps conversion of HTML to PDF or image. The input doesn't validate if it's a valid web URL. Trying to access local files using file:/// work. This allows getting a screenshot/PDF of the sensitive files on the system. 🕵️‍♂️ Proof of Concept A demo...

Auditors: Feds’ Cybersecurity Gets the Dunce Cap

Out of eight U.S. federal agencies identified two years ago with critical cybersecurity failures, seven still don’t meet basic standards, a new audit report found. The Federal government’s overall posture was given just a C-. Audited agencies included the Departments of State, Homeland Security,...

CVE-2021-34638

Authenticated Directory Traversal in WordPress Download Manager = 3.1.24 allows authenticated Contributor+ users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration informatio...

CVE-2021-32706

Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the validDomainWildcard pregmatch filter allows a malicious character through that can be used to execute code, list directories, and...

CVE-2021-20114

When installed following the default/recommended settings, TCExam = 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which included sensitive database backup files...

CVE-2021-20114

When installed following the default/recommended settings, TCExam = 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which included sensitive database backup files...

CVE-2021-20114

CVE-2021-20114 affects TCExam

CVE-2020-5353

The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System NFS allows access to an 'admin' home directory. An attacker may leverage a spoofed Unique Identifier UID over NFS to rewrite sensitive files to gain...

Geutebrück G-Cam E2 和 G-Code 访问控制错误漏洞

Geutebrück G-Cam E2 is a camera from manualslib.Geutebrück G-Code is an analog video encoder module from Geutebrück, Germany. An access control error vulnerability exists in the Geutebrück G-Cam E2 and G-Code, which stems from the default user authentication settings and allows unauthenticated...

NCH WebDictate 路径遍历漏洞

A security vulnerability exists in NCH WebDictate, a web-based dictation recording, editing and management software, which stems from the product's logprop?file=/... path fails to filter incoming special characters, which can be exploited to read critical files...

CVE-2021-33214

In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure, modification of configuration files, or disruption of normal system operation...