CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-36246
https://notcve.org/view.php?id=CVE-2020-36246
Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link. Amaze File Manager versiones anteriores a 3.5.1, permite a atacantes alcanzar privilegios de root por medio de metacaracteres de shell en un enlace simbólico • https://compass-security.com/fileadmin/Research/Advisories/2020-18_CSNC-2020-030_Amaze_FileManager_Privilege_Escalation.txt https://github.com/TeamAmaze/AmazeFileManager/releases/tag/v3.5.1 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-22550
https://notcve.org/view.php?id=CVE-2020-22550
Veno File Manager 3.5.6 is affected by a directory traversal vulnerability. Using the traversal allows an attacker to download sensitive files from the server. Veno File Manager versiones 3.5.6, está afectado por una vulnerabilidad de salto de directorios. El uso del salto permite a un atacante descargar archivos confidenciales desde el servidor. • https://codecanyon.net/item/veno-file-manager-host-and-share-files/6114247 https://gist.github.com/Sp3eD-X/22640377f96340544baf12891f708b8f • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-35173
https://notcve.org/view.php?id=CVE-2020-35173
The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP server (aka services.ftpservice.FTPReceiver.ACTION_START_FTPSERVER and services.ftpservice.FTPReceiver.ACTION_STOP_FTPSERVER). La aplicación Amaze File Manager versiones anteriores a 3.4.2 para Android, no restringe apropiadamente intenciones para controlar el servidor FTP (también se conoce como services.ftpservice.FTPReceiver.ACTION_START_FTPSERVER y services.ftpservice.FTPReceiver.ACTION_STOP_FTPSERVER). • https://github.com/TeamAmaze/AmazeFileManager/compare/v3.4.1...v3.4.2 https://github.com/TeamAmaze/AmazeFileManager/pull/1815 https://play.google.com/store/apps/details?id=com.amaze.filemanager&hl=en_US&gl=US •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12103
https://notcve.org/view.php?id=CVE-2020-12103
In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files (with .bak extension) outside the scope in the same directory in which they are stored. En Tiny File Manager 2.4.1 existe una vulnerabilidad en la funcionalidad de copia de respaldo de archivos ajax que permite a los usuarios autenticados crear copias de respaldo de archivos (con extensión .bak) fuera del alcance en el mismo directorio en el que están almacenados. • https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vulnerabilities https://github.com/prasathmani/tinyfilemanager/commit/a0c595a8e11e55a43eeaa68e1a3ce76365f29d06 https://github.com/prasathmani/tinyfilemanager/issues/357 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12102
https://notcve.org/view.php?id=CVE-2020-12102
In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality. This allows authenticated users to enumerate directories and files on the filesystem (outside of the application scope). En Tiny File Manager versión 2.4.1, hay una vulnerabilidad de Salto de Ruta en la funcionalidad de listado de directorio recursivo de ajax. Esto permite a los usuarios autenticados enumerar directorios y archivos en el sistema de archivos (fuera del alcance de la aplicación). • https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vulnerabilities https://github.com/prasathmani/tinyfilemanager/commit/a0c595a8e11e55a43eeaa68e1a3ce76365f29d06 https://github.com/prasathmani/tinyfilemanager/issues/357 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •