CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-11106
https://notcve.org/view.php?id=CVE-2020-11106
An issue was discovered in Responsive Filemanager through 9.14.0. In the dialog.php page, the session variable $_SESSION['RF']["view_type"] wasn't sanitized if it was already set. This made stored XSS possible if one opens ajax_calls.php and uses the "view" action and places a payload in the type parameter, and then returns to the dialog.php page. This occurs because ajax_calls.php was also able to set the $_SESSION['RF']["view_type"] variable, but there it wasn't sanitized. Se detectó un problema en Responsive Filemanager versiones hasta 9.14.0. • https://github.com/trippo/ResponsiveFilemanager/issues/603 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-10567 – ZwiiCMS 12.2.04 Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-10567
An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validation of what kind of extension is sent. This makes it possible to execute PHP code if a legitimate JPEG image contains this code in the EXIF data, and the .php extension is used in the name parameter. (A potential fast patch is to disable the save_img action in the config file.) Se detectó un problema en Responsive Filemanager versiones hasta 9.14.0. • http://packetstormsecurity.com/files/171280/ZwiiCMS-12.2.04-Remote-Code-Execution.html https://github.com/trippo/ResponsiveFilemanager/issues/600 • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 2CVE-2018-15536 – Responsive FileManager < 9.13.4 - Directory Traversal
https://notcve.org/view.php?id=CVE-2018-15536
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in archives, allowing for the extraction of crafted archives to overwrite arbitrary files via an extract action, aka Directory Traversal. /filemanager/ajax_calls.php en tecrail Responsive FileManager en versiones anteriores a la 9.13.4 no valida correctamente las rutas de archivo en los archivos, lo que permite la extracción de archivos manipulados para sobrescribir archivos arbitrarios mediante una acción "extract". Esto también se conoce como salto de directorio. Responsive FileManager version 9.13.4 suffers from multiple path traversal vulnerabilities. • https://www.exploit-db.com/exploits/45271 http://seclists.org/fulldisclosure/2018/Aug/34 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 96%CPEs: 1EXPL: 2CVE-2018-15535 – Responsive FileManager < 9.13.4 - Directory Traversal
https://notcve.org/view.php?id=CVE-2018-15535
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize get_file sequences such as ".." that can resolve to a location that is outside of that directory, aka Directory Traversal. /filemanager/ajax_calls.php en tecrail Responsive FileManager en versiones anteriores a la 9.13.4 emplea entradas externas para construir un nombre de ruta que debería estar en un directorio restringido, pero no neutraliza correctamente las secuencias get_file como ".." que pueden resolverse en una ubicación fuera de ese directorio. Esto también se conoce como salto de directorio. Responsive FileManager version 9.13.4 suffers from multiple path traversal vulnerabilities. • https://www.exploit-db.com/exploits/45271 http://seclists.org/fulldisclosure/2018/Aug/34 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-15495
https://notcve.org/view.php?id=CVE-2018-15495
/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value. /filemanager/upload.php en Responsive FileManager en versiones anteriores a la 9.13.3 permite un salto de directorio y SSRF porque el parámetro url se usa directamente en una llamada curl_exec, tal y como queda demostrado con un valor en file:///etc/passwd. • http://seclists.org/fulldisclosure/2018/Aug/9 https://github.com/trippo/ResponsiveFilemanager/blob/master/changelog.txt • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •