CVE-2020-10790

openITCOCKPIT before 3.7.3 has unnecessary files such as Lodash files under the web root, which leads to XSS...

CVE-2020-10790: Improper Neutralization of Input During Web Page Generation

openITCOCKPIT before 3.7.3 has unnecessary files such as Lodash files under the web root, which leads to XSS...

PT-2020-12324

Name of the Vulnerable Software and Affected Versions openITCOCKPIT versions prior to 3.7.3 Description The issue arises from unnecessary files, such as Lodash files, being present under the web root, leading to a Cross-Site Scripting XSS vulnerability. Recommendations For versions prior to 3.7.3...

CVE-2019-16064

NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and directories stored outside of the web root folder. By exploiting this vulnerability, it is possible for an attacker to list operating-system directory...

Directory traversal

NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and directories stored outside of the web root folder. By exploiting this vulnerability, it is possible for an attacker to list operating-system directory...

CVE-2014-4019

The ZTE ZXV10 W300 router, running firmware W300V1.0.0a_ZRD_LK , is vulnerable to a sensitive information disclosure flaw. Due to insufficient access control under the web root, remote attackers can perform a direct GET request to download the rom-0 backup file without any authentication. This fi...

PT-2020-7668

Name of the Vulnerable Software and Affected Versions ZTE ZXV10 W300 router version W300V1.0.0a ZRD LK Description The issue concerns the storage of sensitive information under the web root with insufficient access control. This allows remote attackers to read backup files by making a direct...

CVE-2014-4019: Exposure of Sensitive Information to an Unauthorized Actor

ZTE ZXV10 W300 router with firmware W300V1.0.0aZRDLK stores sensitive information under the web root with insufficient access control, which allows remote attackers to read backup files via a direct request for rom-0...

CVE-2015-5951

A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web root and execute system commands...

Unrestricted file upload

A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web root and execute system commands...

CVE-2015-5951: Unrestricted Upload of File with Dangerous Type

A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web root and execute system commands...

CVE-2019-19983

In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be enabled and an admin-ajax request needs to call the fastvelocityminfiles action...

PT-2019-16033

Name of the Vulnerable Software and Affected Versions Fast Velocity Minify versions prior to 2.7.7 Description The issue allows the full web root path to the running WordPress application to be discovered. To exploit this, FVM Debug Mode must be enabled and an admin-ajax request must call the...

Unspecified vulnerability in upload-image-with-ajax

upload-image-with-ajax is an image file upload tool. A security vulnerability exists in upload-image-with-ajax v1.0, which is caused by a logic error in the code. The vulnerability can be exploited to upload arbitrary files to the web root directory and execute code...

CVE-2019-8293

Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...

CVE-2019-8293

Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...

Code injection

Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...

CVE-2019-8293

Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...

CVE-2019-8293: Unrestricted Upload of File with Dangerous Type

Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...

CVE-2019-19374

An issue was discovered in core/assets/form/formquestiontypes/formquestiontypefileupload/formquestiontypefileupload.inc in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3.3 where a user can delete arbitrary files from the server...