1501 matches found
PT-2020-12324
Name of the Vulnerable Software and Affected Versions openITCOCKPIT versions prior to 3.7.3 Description The issue arises from unnecessary files, such as Lodash files, being present under the web root, leading to a Cross-Site Scripting XSS vulnerability. Recommendations For versions prior to 3.7.3...
CVE-2019-16064
NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and directories stored outside of the web root folder. By exploiting this vulnerability, it is possible for an attacker to list operating-system directory...
Directory traversal
NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and directories stored outside of the web root folder. By exploiting this vulnerability, it is possible for an attacker to list operating-system directory...
CVE-2014-4019
The ZTE ZXV10 W300 router, running firmware W300V1.0.0a_ZRD_LK , is vulnerable to a sensitive information disclosure flaw. Due to insufficient access control under the web root, remote attackers can perform a direct GET request to download the rom-0 backup file without any authentication. This fi...
PT-2020-7668
Name of the Vulnerable Software and Affected Versions ZTE ZXV10 W300 router version W300V1.0.0a ZRD LK Description The issue concerns the storage of sensitive information under the web root with insufficient access control. This allows remote attackers to read backup files by making a direct...
CVE-2014-4019: Exposure of Sensitive Information to an Unauthorized Actor
ZTE ZXV10 W300 router with firmware W300V1.0.0aZRDLK stores sensitive information under the web root with insufficient access control, which allows remote attackers to read backup files via a direct request for rom-0...
CVE-2015-5951
A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web root and execute system commands...
Unrestricted file upload
A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web root and execute system commands...
CVE-2015-5951: Unrestricted Upload of File with Dangerous Type
A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web root and execute system commands...
CVE-2019-19983
In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be enabled and an admin-ajax request needs to call the fastvelocityminfiles action...
PT-2019-16033
Name of the Vulnerable Software and Affected Versions Fast Velocity Minify versions prior to 2.7.7 Description The issue allows the full web root path to the running WordPress application to be discovered. To exploit this, FVM Debug Mode must be enabled and an admin-ajax request must call the...
Unspecified vulnerability in upload-image-with-ajax
upload-image-with-ajax is an image file upload tool. A security vulnerability exists in upload-image-with-ajax v1.0, which is caused by a logic error in the code. The vulnerability can be exploited to upload arbitrary files to the web root directory and execute code...
CVE-2019-8293
Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...
CVE-2019-8293
Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...
Code injection
Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...
CVE-2019-8293
Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...
CVE-2019-8293: Unrestricted Upload of File with Dangerous Type
Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...
CVE-2019-19374
An issue was discovered in core/assets/form/formquestiontypes/formquestiontypefileupload/formquestiontypefileupload.inc in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3.3 where a user can delete arbitrary files from the server...
TitanHQ WebTitan has an unspecified vulnerability (CNVD-2019-44522)
TitanHQ WebTitan is a web content filter from TitanHQ Ireland. A security vulnerability exists in TitanHQ WebTitan versions prior to 5.18. The vulnerability can be exploited by an attacker to execute arbitrary code by overwriting an existing file or adding a new PHP file to the web root directory...
CVE-2019-19459
An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. An attacker can write arbitrary content to arbitrary files, as demonstrated by CVE-2019-19458 files under the web root, or .bat files that will be used with auto start. This allows an attacker to execute arbitrary commands on the server...