38 matches found
CVE-2022-45305
Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\Python311 and all files located in that folder...
CVE-2022-45305
Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\Python311 and all files located in that folder...
CVE-2022-45307
Insecure permissions in Chocolatey PHP package v8.1.12 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\tools\php81 and all files located in that folder...
CVE-2021-41241 Advanced permissions is not respected for subfolders in Nextcloud server
Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the...
CVE-2021-41241
Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the...
Groupfolders advanced permissions is not obeyed for subfolders
None...
CVE-2021-41241: Incorrect Authorization
Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the...
HTTP Commander 3.1.9 Cross Site Scripting
Exploit Title: HTTP Commander 3.1.9 - Stored Cross Site Scripting XSS Date: 07/01/2022 Exploit Author: Oscar Sandén Vendor Homepage: https://www.element-it.com Software Link: https://www.element-it.com/downloads.aspx Version: 3.1.9 Tested on: Windows Server 2016 Description There is a stored XSS ...
Apache Tomcat 9.0.0.M1 - Open Redirect Vulnerability
Exploit Title: Apache Tomcat 9.0.0.M1 - Open Redirect Exploit Author: Central InfoSec Version: Apache Tomcat 9.0.0.M1 to 9.0.0.11, 8.5.0 to 8.5.33, and 7.0.23 to 7.0.90 CVE : CVE-2018-11784 Proof of Concept: Identify a subfolder within your application http://example.com/test/ Modify the URL to...
Apache Tomcat 9.0.0.M1 - Open Redirect
Exploit Title: Apache Tomcat 9.0.0.M1 - Open Redirect Date: 10/04/2018 Exploit Author: Central InfoSec Version: Apache Tomcat 9.0.0.M1 to 9.0.0.11, 8.5.0 to 8.5.33, and 7.0.23 to 7.0.90 CVE : CVE-2018-11784 Proof of Concept: Identify a subfolder within your application http://example.com/test/...
Possibility to extend internal-share permissions using the API – ownCloud
An Attacker can extend the permission of a received subfolder share using the ocs api. Additional risk exists because the previlege extension is also possible on public-shares. Affected Software ownCloud Server 10.2.1 CVE-2019-???? core/55a29e0aaef5ebb55cf15ce309d7daaea4fb6c06 Action Taken Added...
Infovista VistaPortal SE Cross-Site Scripting Vulnerability (CNVD-2019-07222)
Infovista VistaPortal SE is a Web-based application from Infovista USA. A cross-site scripting vulnerability exists in the /VPortal/mgtconsole/SubFolderPackages.jsp page in Infovista VistaPortal SE version 5.1 build 51029, which can be exploited by a remote attacker to inject arbitrary web script...
Nextcloud: Expired reshare links allow access to all files in share
After a reshared subfolder link has expired, the link allows access to the full folder. I found the Problem in Nextcloud 14.0.3, but it still persists in 14.0.4 Steps: 1. share folder "A" with an nextcloud group 2. reshare a subfolder "B" of this folder with another user on this group in this cas...
HiDisk 2.4 iOS - (FolderPath) Persistent Vulnerability
Document Title: =============== HiDisk 2.4 iOS - FolderPath Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1496 Release Date: ============= 2015-05-18 Vulnerability Laboratory ID VL-ID: ==================================== 1496...
HP Data Protector - CMD Install Service (Metasploit)
HP Data Protector - CMD Install Service Metasploit This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ Exploit Title: HP Data...
CVE-2012-4774
Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted 1 file name or 2 subfolder name that triggers use of unallocated memory as the destinati...
CVE-2005-2554
The web server for Network Associates ePolicy Orchestrator Agent 3.5.0 patch 3 uses insecure permissions for the "Common Framework\Db" folder, which allows local users to read arbitrary files by creating a subfolder in the EPO agent web root directory...
