CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-25096 – soerennb eXtplorer cross site scripting
https://notcve.org/view.php?id=CVE-2019-25096
A vulnerability has been found in soerennb eXtplorer up to 2.1.12 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.1.13 is able to address this issue. • https://github.com/soerennb/extplorer/commit/b8fcb888f4ff5e171c16797a4b075c6c6f50bf46 https://github.com/soerennb/extplorer/releases/tag/v2.1.13 https://vuldb.com/?ctiid.217435 https://vuldb.com/?id.217435 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-7305 – eXtplorer exposes /usr and /etc/extplorer over HTTP
https://notcve.org/view.php?id=CVE-2019-7305
Information Exposure vulnerability in eXtplorer makes the /usr/ and /etc/extplorer/ system directories world-accessible over HTTP. Introduced in the Makefile patch file debian/patches/debian-changes-2.1.0b6+dfsg-1 or debian/patches/adds-a-makefile.patch, this can lead to data leakage, information disclosure and potentially remote code execution on the web server. This issue affects all versions of eXtplorer in Ubuntu and Debian La vulnerabilidad de exposición a la información en eXtplorer hace que los directorios del sistema /usr/ y /etc/extplorer/ sean de tipo world-accessible a través de HTTP. Introducido en el archivo de parche Makefile debian/patches/debian-changes-2.1.0b6+dfsg-1 o debian/patches/adds-a-makefile.patch, esto puede conllevar a un filtrado de datos, una divulgación de información y potencialmente una ejecución de código remota en el Servidor web. Este problema afecta a todas las versiones de eXtplorer en Ubuntu y Debian. • https://launchpad.net/bugs/1822013 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-552: Files or Directories Accessible to External Parties •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 1CVE-2012-6710
https://notcve.org/view.php?id=CVE-2012-6710
ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to index.php. ext_find_user en eXtplorer hasta la versión 2.1.2 permite que atacantes remotos omitan la autenticación mediante password[]= (o array vacío) en una petición action=login en index.php. • http://itsecuritysolutions.org/2012-12-31-eXtplorer-v2.1-authentication-bypass-vulnerability http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201212-371 https://www.securityfocus.com/bid/57058 • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12756
https://notcve.org/view.php?id=CVE-2017-12756
Command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile[0] parameter. Una inyección de comandos en transferencias desde otro servidor en extplorer en se versiones 2.1.9 y anteriores permite que un atacante inyecte comandos a través del parámetro userfile[0]. • http://extplorer.net/news/21 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.8EPSS: 1%CPEs: 1EXPL: 3CVE-2016-4313 – eXtplorer 2.1.9 - '.ZIP' Directory Traversal
https://notcve.org/view.php?id=CVE-2016-4313
Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitrary files via a .. (dot dot) in an archive file. Vulnerabilidad de salto de directorio en la funcionalidad unzip/extract de eXtplorer 2.1.9 permite a atacantes remotos ejecutar archivos arbitrarios a través de un .. (punto punto) en un archivo. eXtplorer version 2.1.9 suffers from a traversal vulnerability. • https://www.exploit-db.com/exploits/39816 http://hyp3rlinx.altervista.org/advisories/EXTPLORER-ARCHIVE-PATH-TRAVERSAL.txt http://packetstormsecurity.com/files/137031/eXtplorer-2.1.9-Path-Traversal.html http://www.securityfocus.com/archive/1/538386/100/0/threaded http://www.securityfocus.com/bid/98069 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •