2614 matches found
Unauthorized File Access
Overview Affected versions of harp are vulnerable to Unauthorized File Access. If a symlink in the project's base directory points to a file outside of the directory, the file is served. This could allow an attacker to access sensitive files on the server. Recommendation Upgrade to version 0.40.3...
Opus Online Placement University System 4.2.0 Database Disclosure
Exploit Title : Opus Online Placement University System 4.2.0 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 12/04/2019 Vendor Homepage : foss.ulster.ac.uk Software Download Link : foss.ulster.ac.uk/redmine/projects/opus/files...
YiiCMS JetBrains PHPStorm 6.0.3 Database Disclosure
Exploit Title : YiiCMS JetBrains PHPStorm 6.0.3 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 10/04/2019 Vendor Homepage : jetbrains.com - yiiframework.com Software Download Link : github.com/johannesMatevosyan/yii-cms/archive/master.zip...
CVE-2019-3870
A vulnerability was found in Samba from version including 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner root only access. However in some...
Design/Logic Flaw
Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords. Valid credentials are required to access these files and malicious user...
CVE-2019-3870
A vulnerability was found in Samba from version including 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner root only access. However in some...
PT-2019-1579 · Cisco · Nexus 3500 Platform Switches +16
Name of the Vulnerable Software and Affected Versions: Cisco FXOS Software versions prior to 2.2.2.91 and 2.3.1.110 Cisco NX-OS Software versions prior to 2.2.2.91 and 2.3.1.110 Firepower 4100 Series Next-Generation Firewalls versions prior to 2.2.2.91 and 2.3.1.110 Firepower 9300 Series...
HSYCMS suffers from arbitrary file download vulnerability
Hsycms is an enterprise-level web content management system, written by PHP+MYSQL, using template separation technology to support the creation of many types of sites. An arbitrary file download vulnerability exists in HSYCMS, which can be exploited by attackers to obtain sensitive file informati...
GHSA-XG5R-8J97-2WRJ Directory Traversal in restafary
Affected versions of restafary are susceptible to a directory traversal vulnerability when a root path is specified in the configuration. Proof of Concept curl -i -s -k -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd' Recommendation...
CVE-2019-8389
A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. By default, the application runs a transfer service on port 8080, accessible by everyone on the same Wi-Fi network. An attacker can send the POST parameters downfiles and cur-folder with a crafted ../ payload...
Directory Listing
Web servers permitting directory listing are typically used for sharing files. Directory listing allows the client to view a simple list of all the files and folders hosted on the web server. The client is then able to traverse each directory and download the files. Cyber-criminals will utilise t...
CVE-2018-16482
A server directory traversal vulnerability was found on node module mcstatic =0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path...
Remot3d - An Simple Exploit for PHP Language
It's easy to create a backdoor in an instant, the backdoor can be used in a remote process via a Linux terminal on the server that runs the PHP Language program. Made to bypass the system that is disabled on the server, especially for reading sensitive files that are /etc/passwd Screenshots List ...
Unprotected Government Server Exposes Years of FBI Investigations
A massive government data belonging to the Oklahoma Department of Securities ODS was left unsecured on a storage server for at least a week, exposing a whopping 3 terabytes of data containing millions of sensitive files. The unsecured storage server, discovered by Greg Pollock , a researcher with...
Unprotected Government Server Exposes Years of FBI Investigations
A massive government data belonging to the Oklahoma Department of Securities ODS was left unsecured on a storage server for at least a week, exposing a whopping 3 terabytes of data containing millions of sensitive files. The unsecured storage server, discovered by Greg Pollock, a researcher with...
Millions of Oklahoma Gov Files Exposed by Wide-Open Server
Millions of sensitive files on a storage server belonging to the Oklahoma Department of Securities were left exposed for a week – including credentials, internal docs and personal data stretching back decades. Researchers at UpGuard who discovered the data leak said that the publicly accessible...
CVE-2018-20131
The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashplan/log directory. This allows a user to manipulate symbolic links to escalate privileges, or show the contents of sensitive files that a regular user would...
Design/Logic Flaw
The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashplan/log directory. This allows a user to manipulate symbolic links to escalate privileges, or show the contents of sensitive files that a regular user would...
CVE-2018-20131
The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashplan/log directory. This allows a user to manipulate symbolic links to escalate privileges, or show the contents of sensitive files that a regular user would...