CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-35173
https://notcve.org/view.php?id=CVE-2020-35173
30 Dec 2020 — The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP server (aka services.ftpservice.FTPReceiver.ACTION_START_FTPSERVER and services.ftpservice.FTPReceiver.ACTION_STOP_FTPSERVER). La aplicación Amaze File Manager versiones anteriores a 3.4.2 para Android, no restringe apropiadamente intenciones para controlar el servidor FTP (también se conoce como services.ftpservice.FTPReceiver.ACTION_START_FTPSERVER y services.ftpservice.FTPReceiver.ACTION... • https://github.com/TeamAmaze/AmazeFileManager/compare/v3.4.1...v3.4.2 •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12103
https://notcve.org/view.php?id=CVE-2020-12103
28 Apr 2020 — In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files (with .bak extension) outside the scope in the same directory in which they are stored. En Tiny File Manager 2.4.1 existe una vulnerabilidad en la funcionalidad de copia de respaldo de archivos ajax que permite a los usuarios autenticados crear copias de respaldo de archivos (con extensión .bak) fuera del alcance en el mismo directorio en el que est... • https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vulnerabilities • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.7EPSS: 1%CPEs: 1EXPL: 0CVE-2020-12102
https://notcve.org/view.php?id=CVE-2020-12102
28 Apr 2020 — In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality. This allows authenticated users to enumerate directories and files on the filesystem (outside of the application scope). En Tiny File Manager versión 2.4.1, hay una vulnerabilidad de Salto de Ruta en la funcionalidad de listado de directorio recursivo de ajax. Esto permite a los usuarios autenticados enumerar directorios y archivos en el sistema de archivos (fuera del alcance de la apli... • https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vulnerabilities • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-16790 – Remote Code Execution in Tiny File Manager
https://notcve.org/view.php?id=CVE-2019-16790
30 Dec 2019 — In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted. En Tiny File Manager versiones anteriores a la versión 2.3.9, Hay una ejecución de código remota por medio Upload desde URL y Edit/Rename files. Solo los usuarios autenticados están afectados. • https://github.com/prasathmani/tinyfilemanager/commit/9a499734c5084e3c2eb505f100d50baac1793bd8 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-19041 – Media File Manager <= 1.4.2 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-19041
05 Nov 2018 — The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI. El plugin Media File Manager 1.4.2 para WordPress permite Cross-Site Scripting (XSS) en el parámetro dir de una acción mrelocator_getdir en el URI wp-admin/admin-ajax.php. • https://www.exploit-db.com/exploits/45809 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 10%CPEs: 1EXPL: 1CVE-2018-19040 – Media File Manager <= 1.4.2 - Directory Traversal to Directory Listing
https://notcve.org/view.php?id=CVE-2018-19040
11 May 2018 — The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI. El plugin Media File Manager 1.4.2 para WordPress permite el listado de directorios mediante un salto de directorio por ../ en el parámetro dir de una acción mrelocator_getdir en el URI wp-admin/admin-ajax.php. The Media File Manager plugin up to and including version 1.4.2 for WordPress allows directory listing via a... • https://www.exploit-db.com/exploits/45809 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 5%CPEs: 1EXPL: 1CVE-2018-19042 – Media File Manager <= 1.4.2 - Directory Traversal to Arbitrary File Relocation
https://notcve.org/view.php?id=CVE-2018-19042
11 May 2018 — The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mrelocator_move action to the wp-admin/admin-ajax.php URI. El plugin Media File Manager 1.4.2 para WordPress permite el movimiento de archivos arbitrario mediante un salto de directorio por ../ en los parámetros dir_from y dir_to de una acción mrelocator_move en el URI wp-admin/admin-ajax.php. • https://www.exploit-db.com/exploits/45809 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 5%CPEs: 1EXPL: 1CVE-2018-19043 – Media File Manager <= 1.4.2 - Directory Traversal to Arbitrary File Read
https://notcve.org/view.php?id=CVE-2018-19043
11 May 2018 — The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory traversal in the dir parameter of an mrelocator_rename action to the wp-admin/admin-ajax.php URI. El plugin Media File Manager 1.4.2 para WordPress permite renombrar archivos arbitrarios (especificando un nombre de archivo "from" y "to") mediante un salto de directorio por ../ en el parámetro dir de una acción mrelocator_rename en el URI wp-admin/admin-ajax.php. The Me... • https://www.exploit-db.com/exploits/45809 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2017-8297
https://notcve.org/view.php?id=CVE-2017-8297
27 Apr 2017 — A path traversal vulnerability exists in simple-file-manager before 2017-04-26, affecting index.php (the sole "Simple PHP File Manager" component). Existe una vulnerabilidad de salto de directorio en el gestor de archivos Simple PHP File Manager anterior al 26-04-2017, que afecta a index.php (el único componente de "Simple PHP File Manager"). • https://github.com/jcampbell1/simple-file-manager/commit/de52e7ee61a842d8fdf791f2a5b7c91b6c5cdb56 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 1%CPEs: 6EXPL: 2CVE-2008-7027 – Libra PHP File Manager 1.18 - Insecure Cookie Handling
https://notcve.org/view.php?id=CVE-2008-7027
21 Aug 2009 — Libra File Manager 1.18 and earlier allows remote attackers to bypass authentication and gain privileges by setting the user and pass cookies to 1. Libra File Manager 1.18 y versiones anteriores permite a atacantes remotos eludir la autenticación y obtener privilegios mediante el establecimiento de las cookies "user" y "pass" a 1. • https://www.exploit-db.com/exploits/6579 • CWE-287: Improper Authentication •