Filtered by CWE-829
Filtered by vendor Subscriptions
Total 178 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-24985 1 Quadbase 1 Espressdashboard 2024-11-21 8.1 High
An issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able to navigate to the MenuPage section of the application, and change the frmsrc parameter value to retrieve and execute external files or payloads.
CVE-2020-22474 1 Weberp 1 Weberp 2024-11-21 6.5 Medium
In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion.
CVE-2020-16152 1 Extremenetworks 1 Aerohive Netconfig 2024-11-21 9.8 Critical
The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.
CVE-2020-16012 3 Google, Mozilla, Redhat 5 Chrome, Firefox, Enterprise Linux and 2 more 2024-11-21 4.3 Medium
Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2020-15655 3 Canonical, Mozilla, Opensuse 5 Ubuntu Linux, Firefox, Firefox Esr and 2 more 2024-11-21 6.5 Medium
A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
CVE-2020-13977 2 Fedoraproject, Nagios 2 Fedora, Nagios 2024-11-21 4.9 Medium
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408.
CVE-2020-13651 1 Digdash 1 Digdash 2024-11-21 7.8 High
An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200421, and 2019R2 before p20200430. It allows a user to provide data that will be used to generate the JNLP file used by a client to obtain the right Java application. By providing an attacker-controlled URL, the client will obtain a rogue JNLP file specifying the installation of malicious JAR archives and executed with full privileges on the client computer.
CVE-2020-13175 1 Teradici 2 Cloud Access Connector, Cloud Access Connector Legacy 2024-11-21 7.5 High
The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 and earlier for Cloud Access Connector) contains a local file inclusion vulnerability which allows an unauthenticated remote attacker to leak LDAP credentials via a specially crafted HTTP request.
CVE-2020-10865 2 Avast, Microsoft 2 Antivirus, Windows 2024-11-21 7.5 High
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to make arbitrary changes to the Components section of the Stats.ini file via RPC from a Low Integrity process.
CVE-2019-9829 1 Maccms 1 Maccms 2024-11-21 N/A
Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates.
CVE-2019-9817 2 Mozilla, Redhat 4 Firefox, Firefox Esr, Thunderbird and 1 more 2024-11-21 N/A
Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVE-2019-9797 2 Mozilla, Redhat 2 Firefox, Enterprise Linux 2024-11-21 N/A
Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox < 66.
CVE-2019-8154 1 Magento 1 Magento 2024-11-21 8.8 High
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update.
CVE-2019-5479 1 Larvit 1 Larvitbase 2024-11-21 7.5 High
An unintended require vulnerability in <v0.5.5 larvitbase-api may allow an attacker to load arbitrary non-production code (JavaScript file).
CVE-2019-4263 1 Ibm 1 Content Navigator 2024-11-21 4.3 Medium
IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server. IBM X-Force ID: 160015.
CVE-2019-17400 2 Redhat, Universal Office Converter Project 2 Enterprise Linux, Universal Office Converter 2024-11-21 7.5 High
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.
CVE-2019-17014 1 Mozilla 1 Firefox 2024-11-21 7.4 High
If an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in a cross-origin information leak. This vulnerability affects Firefox < 71.
CVE-2019-16951 1 Enghouse 1 Web Chat 2024-11-21 5.3 Medium
A remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attacker's data and displays it. Also worth mentioning is the amount of information sent in the request from this product to the attacker: it reveals information the public should not have. This includes pathnames and internal ip addresses.
CVE-2019-15839 1 Shaosina 1 Sina Extension For Elementor 2024-11-21 N/A
The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.
CVE-2019-13589 1 Anjlab 1 Paranoid2 2024-11-21 N/A
The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.