Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
366 results · page 6 of 8
Apr 4, 2022Use after free in File Manager in Google Chrome on Chrome OS prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a craftCVE-2022-0603 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in File Manager in Google Chrome on Chrome OS prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Apr 4, 2022Library File Manager: Is using an outdated version of the elFinder libraryCVE-2022-0403 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by security issues (CVE-2021-32682), and does not have any authorisation as well as CSRF checks in its connector AJAX action, allowing any authenticated users, such as subscriber to call it. Furthermore, as the options passed to the elFinder library does not restrict any file type, users with a role as low as subscriber can Create/Upload/Delete Arbitrary files and folders.
- Product
- Library File Manager
- Fixed in
- 5.2.3
- What to do
- Update Library File Manager to 5.2.3 or newer.
Mar 28, 2022A vulnerability classified as problematic has been found in Mirmay Secure Private Browser and File Manager up to 2.5.CVE-2018-25030 · Other software · Mirmay · reported by VulDBLow 3.3
A vulnerability classified as problematic has been found in Mirmay Secure Private Browser and File Manager up to 2.5. Affected is the Auto Lock. A race condition leads to a local authentication bypass. The exploit has been disclosed to the public and may be used.
- Product
- Secure Private Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid useCVE-2021-45010 · Other software · Prasathmani · reported by MITREHigh 8.8
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.
- Product
- Tiny File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comfebin0x4e4a.wordpress.com
Feb 24, 2022The copy function of the file manager in Cuppa CMS v1.0 allows any file to be copied to the current directory, granting attackers read access to arbitrary filesCVE-2022-25401 · Other software · Cuppacms · reported by MITREHigh 7.5
The copy function of the file manager in Cuppa CMS v1.0 allows any file to be copied to the current directory, granting attackers read access to arbitrary files.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022Use after free in File Manager API in Google Chrome on Chrome OS prior to 97.0.4692.71 allowed an attacker who convinced a user to install a malicious extensionCVE-2022-0107 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in File Manager API in Google Chrome on Chrome OS prior to 97.0.4692.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Dec 28, 2021An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards.CVE-2021-37401 · Other software · Idec · reported by MITRECritical 9.8
An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the PLC user program may be uploaded, altered, and/or downloaded.
- Product
- Data File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2021An attacker may obtain the user credentials from the communication between the PLC and the software.CVE-2021-37400 · Other software · Idec · reported by MITRECritical 9.8
An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the PLC user program may be uploaded, altered, and/or downloaded.
- Product
- Data File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2021A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 anCVE-2021-22968 · Other software · Concretecms · reported by support@hackerone.comHigh 7.2
A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below.The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with a random name, but it's possible to stall the uploads and brute force the directory name. You have to be an admin with the ability to upload files, but this bug gives you the ability to upload restricted file types and execute them depending on server configuration.To fix this, a check for allowed file extensions was added before downloading files to a tmp directory.Concrete CMS Security Team gave this a CVSS v3.1 score of 5.4 AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:NThis fix is also in Concrete version 9.0.0
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orghackerone.com
Nov 3, 2021With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component.CVE-2021-36697 · Other software · Artica · reported by MITREMedium 6.7
With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component. The new .htaccess file contains a Rewrite Rule with a type definition. A normal PHP file can be uploaded with this new "file type" and the code can be executed with an HTTP request.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordk4m1ll0.comk4m1ll0.com
Sep 15, 2021A Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager.php when the server is given a file that contains HTML and javaCVE-2021-40966 · Other software · Prasathmani · reported by MITREMedium 5.4
A Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager.php when the server is given a file that contains HTML and javascript in its name. A malicious user can upload a file with a malicious filename containing javascript code and it will run on any user browser when they access the server.
- Product
- Tiny File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 15, 2021A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run CVE-2021-40965 · Other software · Prasathmani · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run OS commands by inducing the Administrator user to browse a URL controlled by an attacker.
- Product
- Tiny File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 15, 2021A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file (with Admin credentials orCVE-2021-40964 · Other software · Prasathmani · reported by MITREMedium 6.5
A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file (with Admin credentials or with the CSRF vulnerability) with the "fullpath" parameter containing path traversal strings (../ and ..\) in order to escape the server's intended working directory and write malicious files onto any directory on the computer.
- Product
- Tiny File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgist.github.com
Jun 30, 2021In Artica Pandora FMS <=754 in the File Manager component, there is sensitive information exposed on the client side which attackers can access.CVE-2021-34075 · Other software · Artica · reported by MITREMedium 5.9
In Artica Pandora FMS <=754 in the File Manager component, there is sensitive information exposed on the client side which attackers can access.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordk4m1ll0.comk4m1ll0.com
Jun 25, 2021PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager.CVE-2021-34074 · Other software · Pandorafms · reported by MITRECritical 9.8
PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. To bypass the built-in protection, a relative path is used in the requests.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordk4m1ll0.comk4m1ll0.com
Jun 22, 2021Ampache is an open source web based audio/video streaming application and file manager.CVE-2021-32644 · Other software · ampache · reported by GitHubMedium 6.4
Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are vulnerable to code injection in random.php. The attack requires user authentication to access the random.php page unless the site is running in demo mode. This issue has been resolved in 4.4.3.
- Product
- ampache
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2021elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.CVE-2021-32682 · Other software · Studio-42 · reported by GitHubCritical 9.8
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.
- Product
- elFinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comblog.sonarsource.com
Apr 13, 2021Ampache is a web based audio/video streaming application and file manager.CVE-2021-21399 · Other software · ampache · reported by GitHubCritical 9.1
Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic API. To successfully make the attack you must use a username that is not part of the site to bypass the auth checks. For more details and workaround guidance see the referenced GitHub security advisory.
- Product
- ampache
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2021In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_managerCVE-2021-24177 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response.
- Product
- File Manager
- Fixed in
- 7.1
- What to do
- Update File Manager to 7.1 or newer.
Full record and what to do →NVD recordn4nj0.github.ioplugins.trac.wordpress.org
Feb 19, 2021Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link.CVE-2020-36246 · Other software · Amaze File Manager Project · reported by MITREHigh 7.8
Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link.
- Product
- Amaze File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcompass-security.comgithub.com
Feb 12, 2021Directory traversal vulnerability in ELECOM File Manager all versions allows remote attackers to create an arbitrary file or overwrite an existing file in a dirCVE-2021-20651 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpCritical 9.1
Directory traversal vulnerability in ELECOM File Manager all versions allows remote attackers to create an arbitrary file or overwrite an existing file in a directory which can be accessed with the application privileges via unspecified vectors.
- Product
- ELECOM File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2021Veno File Manager 3.5.6 is affected by a directory traversal vulnerability.CVE-2020-22550 · Other software · Veno File Manager Project · reported by MITREHigh 7.5
Veno File Manager 3.5.6 is affected by a directory traversal vulnerability. Using the traversal allows an attacker to download sensitive files from the server.
- Product
- Veno File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netgist.github.com
Dec 30, 2020The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP server (aka services.ftpservice.FTPReceivCVE-2020-35173 · Other software · Amaze File Manager Project · reported by MITRECritical 9.8
The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP server (aka services.ftpservice.FTPReceiver.ACTION_START_FTPSERVER and services.ftpservice.FTPReceiver.ACTION_STOP_FTPSERVER).
- Product
- Amaze File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2020Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then upload a Trojan horCVE-2020-25106 · Other software · Supremocontrol · reported by MITREHigh 7.8
Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then upload a Trojan horse with the Supremo.exe filename.
- Product
- Supremo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 23, 2020Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonstrated by the file manager.CVE-2019-14719 · Other software · Verifone · reported by MITREHigh 7.8
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonstrated by the file manager.
- Product
- Mx900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordptsecurity.comptsecurity.com
Oct 5, 2020The file manager option in CuppaCMS before 2019-11-12 allows an authenticated attacker to upload a malicious file within an image extension and through a customCVE-2020-26048 · Other software · Cuppacms · reported by MITREHigh 8.8
The file manager option in CuppaCMS before 2019-11-12 allows an authenticated attacker to upload a malicious file within an image extension and through a custom request using the rename function provided by the file manager is able to modify the image extension into PHP resulting in remote arbitrary code execution.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2020WordPress File Manager Plugin Remote Code Execution VulnerabilityCVE-2020-25213 · WordPress plugins & themes · reported by MITREExploitedCritical 10
WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.
- Product
- File Manager Plugin
- Fixed in
- 6.9
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Sep 4, 2020Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager.CVE-2020-24986 · Other software · Concretecms · reported by MITREHigh 7.2
Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Aug 26, 2020mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file.CVE-2020-24312 · Other software · Filemanagerpro · reported by MITREHigh 7.5
mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken.
- Product
- File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzeroaptitude.comzeroaptitude.com
Aug 14, 2020CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798.CVE-2020-17462 · Other software · Cmsmadesimple · reported by MITREHigh 7.8
CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jun 10, 2020Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature.CVE-2020-13852 · Other software · Pandorafms · reported by MITREHigh 7.2
Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcoresecurity.comcoresecurity.com
Apr 28, 2020In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of filesCVE-2020-12103 · Other software · Prasathmani · reported by MITREHigh 7.7
In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files (with .bak extension) outside the scope in the same directory in which they are stored.
- Product
- Tiny File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberaz0r.infogithub.com
Apr 28, 2020In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality.CVE-2020-12102 · Other software · Prasathmani · reported by MITREHigh 7.7
In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality. This allows authenticated users to enumerate directories and files on the filesystem (outside of the application scope).
- Product
- Tiny File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberaz0r.infogithub.com
Feb 10, 2020A CSRF vulnerability exists in the File Types component of Web File Manager in Rumpus FTP 8.2.9.1 that allows an attacker to add or delete the file types that aCVE-2019-19668 · Other software · Maxum · reported by MITREMedium 4.3
A CSRF vulnerability exists in the File Types component of Web File Manager in Rumpus FTP 8.2.9.1 that allows an attacker to add or delete the file types that are used on the server via RAPR/TriggerServerFunction.html.
- Product
- Rumpus FTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2020A HTTP Response Splitting vulnerability was identified in the Web Settings Component of Web File Manager in Rumpus FTP Server 8.2.9.1.CVE-2019-19670 · Other software · Maxum · reported by MITREMedium 6.1
A HTTP Response Splitting vulnerability was identified in the Web Settings Component of Web File Manager in Rumpus FTP Server 8.2.9.1. A successful exploit can result in stored XSS, website defacement, etc. via ExtraHTTPHeader to RAPR/WebSettingsGeneralSet.html.
- Product
- Rumpus FTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2020A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1.CVE-2019-19669 · Other software · Maxum · reported by MITREMedium 6.5
A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1. This could allow an attacker to delete, create, and update the upload forms via RAPR/TriggerServerFunction.html.
- Product
- Rumpus FTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2020A CSRF vulnerability exists in the Block Clients component of Web File Manager in Rumpus FTP 8.2.9.1 that could allow an attacker to whitelist or block any IP aCVE-2019-19667 · Other software · Maxum · reported by MITREMedium 5.4
A CSRF vulnerability exists in the Block Clients component of Web File Manager in Rumpus FTP 8.2.9.1 that could allow an attacker to whitelist or block any IP address via RAPR/BlockedClients.html.
- Product
- Rumpus FTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2020A CSRF vulnerability exists in the Event Notices Settings of Web File Manager in Rumpus FTP 8.2.9.1.CVE-2019-19666 · Other software · Maxum · reported by MITREMedium 4.3
A CSRF vulnerability exists in the Event Notices Settings of Web File Manager in Rumpus FTP 8.2.9.1. An attacker can create/update event notices via RAPR/EventNoticesSet.html.
- Product
- Rumpus FTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2020A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp.CVE-2019-19661 · Other software · Maxum · reported by MITREMedium 6.1
A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp.
- Product
- Rumpus FTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2020A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1.CVE-2019-19664 · Other software · Maxum · reported by MITREHigh 7.1
A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server Web settings at RAPR/WebSettingsGeneralSet.html.
- Product
- Rumpus FTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2020A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1.CVE-2019-19662 · Other software · Maxum · reported by MITREMedium 6.5
A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can Create and Delete accounts via RAPR/TriggerServerFunction.html.
- Product
- Rumpus FTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2020A CSRF vulnerability exists in the FTP Settings of Web File Manager in Rumpus FTP 8.2.9.1.CVE-2019-19665 · Other software · Maxum · reported by MITREMedium 6.5
A CSRF vulnerability exists in the FTP Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server FTP settings at RAPR/FTPSettingsSet.html.
- Product
- Rumpus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2020A CSRF vulnerability exists in the Folder Sets Settings of Web File Manager in Rumpus FTP 8.2.9.1.CVE-2019-19663 · Other software · Maxum · reported by MITREMedium 6.5
A CSRF vulnerability exists in the Folder Sets Settings of Web File Manager in Rumpus FTP 8.2.9.1. This allows an attacker to Create/Delete Folders after exploiting it at RAPR/FolderSetsSet.html.
- Product
- Rumpus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2020A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1.CVE-2019-19660 · Other software · Maxum · reported by MITREMedium 6.5
A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate the SMTP setting and other network settings via RAPR/NetworkSettingsSet.html.
- Product
- Rumpus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Feb 10, 2020A CSRF vulnerability exists in the Web File Manager's Edit Accounts functionality of Rumpus FTP Server 8.2.9.1.CVE-2019-19659 · Other software · Maxum · reported by MITREHigh 8.8
A CSRF vulnerability exists in the Web File Manager's Edit Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can take over a user account by changing the password, update users' details, and escalate privileges via RAPR/DefineUsersSet.html.
- Product
- Rumpus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2020Easytime Studio Easy File Manager 1.1 has a HTTP request security bypassCVE-2013-3960 · Other software · Easytimestudio · reported by MITRECritical 9.9
Easytime Studio Easy File Manager 1.1 has a HTTP request security bypass
- Product
- Easy File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comtrustwave.com
Dec 30, 2019In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files.CVE-2019-16790 · Other software · Tiny File Manager · reported by GitHubMedium 6.5
In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted.
- Product
- Tiny File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2019A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1.CVE-2019-19368 · Other software · Maxum · reported by MITREMedium 6.1
A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker can exploit it by sending a crafted link to end users and can execute arbitrary Javascripts
- Product
- Rumpus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 16, 2019CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.CVE-2019-17629 · Other software · Cmsmadesimple · reported by MITREMedium 4.8
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.cmsmadesimple.orgforum.cmsmadesimple.org
Sep 5, 2019The master-password feature in the ES File Explorer File Manager application 4.2.0.1.3 for Android can be bypassed via a com.estrongs.android.pop.ftp.ESFtpShortCVE-2019-11380 · Other software · Estrongs · reported by MITREHigh 7.5
The master-password feature in the ES File Explorer File Manager application 4.2.0.1.3 for Android can be bypassed via a com.estrongs.android.pop.ftp.ESFtpShortcut intent, leading to remote FTP access to the entirety of local storage.
- Product
- ES File Explorer File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.