Total
7067 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-19360 | 1 Fhem | 1 Fhem | 2024-11-21 | 7.5 High |
| Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a file, which can lead to sensitive information disclosure. | ||||
| CVE-2020-19305 | 1 Metinfo | 1 Metinfo | 2024-11-21 | 9.8 Critical |
| An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackers to escalate privileges. | ||||
| CVE-2020-19304 | 1 Metinfo | 1 Metinfo | 2024-11-21 | 7.5 High |
| An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive information. | ||||
| CVE-2020-19154 | 1 Jflyfox | 1 Jfinal Cms | 2024-11-21 | 6.5 Medium |
| Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'. | ||||
| CVE-2020-19150 | 1 Jflyfox | 1 Jfinal Cms | 2024-11-21 | 8.1 High |
| Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete()' function in the component 'modules/filemanager/FileManagerController.java'. | ||||
| CVE-2020-19147 | 1 Jflyfox | 1 Jfinal Cms | 2024-11-21 | 6.5 Medium |
| Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' function in the component '/modules/filemanager/FileManager.java'. | ||||
| CVE-2020-19146 | 1 Jflyfox | 1 Jfinal Cms | 2024-11-21 | 6.5 Medium |
| Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' parameter in the component 'jfinal_cms/admin/folder/list'. | ||||
| CVE-2020-18878 | 1 Skycaiji | 1 Skycaiji | 2024-11-21 | 5.3 Medium |
| Directory Traversal in Skycaiji v1.3 allows remote attackers to obtain sensitive information via the component 'index.php?m=admin&c=Tool&a=log&file=D%3A%5CphpStudy%5CWWW%5Cindex.php'. | ||||
| CVE-2020-18665 | 1 Webport | 1 Web Port | 2024-11-21 | 5.3 Medium |
| Directory Traversal vulnerability in WebPort <=1.19.1 in tags of system settings. | ||||
| CVE-2020-18438 | 1 Phpok | 1 Phpok | 2024-11-21 | 7.5 High |
| Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin.php. | ||||
| CVE-2020-18331 | 1 Chinamobileltd | 2 Gpn2.4p21-c-cn, Gpn2.4p21-c-cn Firmware | 2024-11-21 | 9.1 Critical |
| Directory traversal vulnerability in ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01(hardware platform Gpn2.4P21-C_WIFI-V0.05), via the getpage parameter to /cgi-bin/webproc. | ||||
| CVE-2020-18330 | 1 Chinamobileltd | 2 Gpn2.4p21-c-cn, Gpn2.4p21-c-cn Firmware | 2024-11-21 | 9.1 Critical |
| An issue was discovered in the default configuration of ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01(hardware platform Gpn2.4P21-C_WIFI-V0.05), allows attackers to gain access to the configuration interface. | ||||
| CVE-2020-18191 | 1 Get-simple | 1 Getsimplecms | 2024-11-21 | 9.1 Critical |
| GetSimpleCMS-3.3.15 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /GetSimpleCMS-3.3.15/admin/log.php | ||||
| CVE-2020-18190 | 1 Bludit | 1 Bludit | 2024-11-21 | 9.1 Critical |
| Bludit v3.8.1 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /admin/ajax/upload-profile-picture. | ||||
| CVE-2020-18178 | 1 Hongcms Project | 1 Hongcms | 2024-11-21 | 9.8 Critical |
| Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax." | ||||
| CVE-2020-18127 | 1 Indexhibit | 1 Indexhibit | 2024-11-21 | 6.5 Medium |
| An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files. | ||||
| CVE-2020-18070 | 1 Idreamsoft | 1 Icms | 2024-11-21 | 9.1 Critical |
| Path Traversal in iCMS v7.0.13 allows remote attackers to delete folders by injecting commands into a crafted HTTP request to the "do_del()" method of the component "database.admincp.php". | ||||
| CVE-2020-17564 | 1 Feifeicms | 1 Feifeicms | 2024-11-21 | 9.1 Critical |
| Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataAction.class.php" component. | ||||
| CVE-2020-17563 | 1 Feifeicms | 1 Feifeicms | 2024-11-21 | 9.1 Critical |
| Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to " /index.php?s=/admin-tpl-del&id=". | ||||
| CVE-2020-17389 | 1 Marvell | 1 Qconvergeconsole | 2024-11-21 | 8.8 High |
| This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the decryptFile method of the GWTTestServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10502. | ||||