CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-36246
https://notcve.org/view.php?id=CVE-2020-36246
Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link. Amaze File Manager versiones anteriores a 3.5.1, permite a atacantes alcanzar privilegios de root por medio de metacaracteres de shell en un enlace simbólico • https://compass-security.com/fileadmin/Research/Advisories/2020-18_CSNC-2020-030_Amaze_FileManager_Privilege_Escalation.txt https://github.com/TeamAmaze/AmazeFileManager/releases/tag/v3.5.1 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-35173
https://notcve.org/view.php?id=CVE-2020-35173
The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP server (aka services.ftpservice.FTPReceiver.ACTION_START_FTPSERVER and services.ftpservice.FTPReceiver.ACTION_STOP_FTPSERVER). La aplicación Amaze File Manager versiones anteriores a 3.4.2 para Android, no restringe apropiadamente intenciones para controlar el servidor FTP (también se conoce como services.ftpservice.FTPReceiver.ACTION_START_FTPSERVER y services.ftpservice.FTPReceiver.ACTION_STOP_FTPSERVER). • https://github.com/TeamAmaze/AmazeFileManager/compare/v3.4.1...v3.4.2 https://github.com/TeamAmaze/AmazeFileManager/pull/1815 https://play.google.com/store/apps/details?id=com.amaze.filemanager&hl=en_US&gl=US •