EUVD-2018-13153

Malware in sbrugna...

CVE-2018-20603

Lei Feng TV CMS aka LFCMS 3.8.6 allows admin.php?s=/Member/add.html CSRF...

CVE-2018-20604

Lei Feng TV CMS aka LFCMS 3.8.6 allows Directory Traversal via crafted use of .. in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/edit/path/web........1.txt.html URI to read the 1.txt file...

CVE-2018-20602

Lei Feng TV CMS aka LFCMS 3.8.6 allows full path disclosure via the /install.php?s=/1 URI...

CVE-2018-20604

Lei Feng TV CMS aka LFCMS 3.8.6 allows Directory Traversal via crafted use of .. in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/edit/path/web........1.txt.html URI to read the 1.txt file...

CVE-2018-20604

Lei Feng TV CMS aka LFCMS 3.8.6 allows Directory Traversal via crafted use of .. in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/edit/path/web........1.txt.html URI to read the 1.txt file...

CVE-2018-20603

Lei Feng TV CMS aka LFCMS 3.8.6 allows admin.php?s=/Member/add.html CSRF...

CVE-2018-20604

Lei Feng TV CMS aka LFCMS 3.8.6 allows Directory Traversal via crafted use of .. in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/edit/path/web........1.txt.html URI to read the 1.txt file...

CVE-2018-20602

CVE-2018-20602 affects Lei Feng TV CMS (LFCMS) 3.8.6. The vulnerability is an information disclosure via the URI /install.php?s=/1, resulting in full path disclosure. Multiple connected records corroborate this issue across sources (NVD entry, RH Red Hat advisory, CNVD/CNVD-2019-00991, PRION, etc...

CVE-2018-20603

The CVE-2018-20603 entry concerns Lei Feng TV CMS (aka LFCMS) version 3.8.6, which is vulnerable to CSRF on the admin page admin.php?s=/Member/add.html. The root cause, as stated across connected records, is a cross-site request forgery vulnerability in the LFCMS 3.8.6 administrative interface, e...

CVE-2018-20604

CVE-2018-20604 affects Lei Feng TV CMS (LFCMS) 3.8.6. A Directory Traversal is possible by crafting URIs using ..* in Template/edit/path, e.g., admin.php?s=/Template/edit/path/web .... ..*..*1.txt.html, enabling reading of arbitrary files (demonstrated with 1.txt). The connected records confirm t...

CVE-2018-20604: Improper Limitation of a Pathname to a Restricted Directory

Lei Feng TV CMS aka LFCMS 3.8.6 allows Directory Traversal via crafted use of .. in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/edit/path/web........1.txt.html URI to read the 1.txt file...

CVE-2018-20603: Cross-Site Request Forgery (CSRF)

Lei Feng TV CMS aka LFCMS 3.8.6 allows admin.php?s=/Member/add.html CSRF...

CVE-2018-20602: Exposure of Sensitive Information to an Unauthorized Actor

Lei Feng TV CMS aka LFCMS 3.8.6 allows full path disclosure via the /install.php?s=/1 URI...

PT-2018-15467

Name of the Vulnerable Software and Affected Versions Lei Feng TV CMS aka LFCMS version 3.8.6 Description The issue allows for a CSRF attack on the admin.php?s=/Member/add.html endpoint. Recommendations For Lei Feng TV CMS aka LFCMS version 3.8.6, consider implementing CSRF protection measures,...

PT-2018-15468

Name of the Vulnerable Software and Affected Versions Lei Feng TV CMS aka LFCMS version 3.8.6 Description The issue allows Directory Traversal via crafted use of .. in Template/edit/path URIs. For example, the admin.php?s=/Template/edit/path/web........1.txt.html URI can be used to read the 1.txt...

PT-2018-15466

Name of the Vulnerable Software and Affected Versions Lei Feng TV CMS aka LFCMS version 3.8.6 Description The issue allows for full path disclosure via the "/install.php?s=/1" API endpoint. This could potentially reveal sensitive information about the system's directory structure. Recommendations...