CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36488
https://notcve.org/view.php?id=CVE-2020-36488
22 Oct 2021 — An issue in the FTP server of Sky File v2.1.0 allows attackers to perform directory traversal via `/null//` path commands. Un problema en el servidor FTP de Sky File versión v2.1.0, permite a atacantes llevar a cabo un salto de directorio por medio de comandos de ruta "/null//" • https://www.vulnerability-lab.com/get_content.php?id=2207 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-28233
https://notcve.org/view.php?id=CVE-2021-28233
27 Aug 2021 — Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the ok_jpg_generate_huffman_table function in ok_jpg.c. Se presenta una vulnerabilidad de desbordamiento de búfer en la región heap de la memoria en ok-file-manerats 1 por medio de la función ok_jpg_generate_huffman_table en el archivo ok_jpg.c. • https://github.com/brackeen/ok-file-formats/issues/11 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-32263
https://notcve.org/view.php?id=CVE-2021-32263
24 Aug 2021 — ok-file-formats through 2021-04-29 has a heap-based buffer overflow in the ok_csv_circular_buffer_read function in ok_csv.c. ok-file-formats hasta el 29-04-2021, presenta un desbordamiento de búfer en la región heap de la memoria en la función ok_csv_circular_buffer_read en el archivo ok_csv.c. • https://github.com/brackeen/ok-file-formats/issues/13 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-23707
https://notcve.org/view.php?id=CVE-2020-23707
15 Jul 2021 — A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_progressive() at ok_jpg.c:1054 of ok-file-formats through 2020-06-26 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file. Una vulnerabilidad de desbordamiento de búfer en la región heap de la memoria en la función ok_jpg_decode_block_progressive() en el archivo ok_jpg.c:1054 de ok-file-formats hasta el 26-06-2020, permite a atacantes causar una Denegación de Servicio (DOS) por medio de un archivo jpeg dise... • https://cwe.mitre.org/data/definitions/122.html • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-23706
https://notcve.org/view.php?id=CVE-2020-23706
15 Jul 2021 — A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_subsequent_scan() ok_jpg.c:1102 of ok-file-formats through 2020-06-26 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file. Una vulnerabilidad de desbordamiento de búfer en la región heap de la memoria en la función ok_jpg_decode_block_subsequent_scan() del archivo ok_jpg.c:1102 de ok-file-formats versiones hasta el 26-06-2020, permite a atacantes causar una Denegación de Servicio (DOS) por medio de un arch... • https://github.com/brackeen/ok-file-formats/issues/7 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24367 – WP Config File Editor <= 1.7.1 - Authenticated Stored Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24367
31 May 2021 — The WP Config File Editor WordPress plugin through 1.7.1 was affected by an Authenticated Stored Cross-Site Scripting (XSS) vulnerability. El plugin de WordPress WP Config File Editor versiones hasta 1.7.1, estaba afectado por una vulnerabilidad de tipo Cross-Site Scripting (XSS) Almacenada y Autenticada • https://wpscan.com/vulnerability/f35b7c8f-cfb6-42b6-8a3a-8c07cd1e9da0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.6EPSS: 1%CPEs: 1EXPL: 0CVE-2020-24144 – Media File Organizer <= 1.0.1 - Directory Traversal
https://notcve.org/view.php?id=CVE-2020-24144
13 Apr 2021 — Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outside the web root folder via the items[] parameter in a move operation. Un salto de Directorio en el plugin Media File Organizer (también se conoce como media-file-organizer) versión 1.0.1 para WordPress, permite a un atacante acceder a archivos almacenados fuera de la carpeta root de la web por medio del parámetro items[] en una operación de movimient... • https://github.com/secwx/research/blob/main/cve/CVE-2020-24144.md • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-36246
https://notcve.org/view.php?id=CVE-2020-36246
19 Feb 2021 — Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link. Amaze File Manager versiones anteriores a 3.5.1, permite a atacantes alcanzar privilegios de root por medio de metacaracteres de shell en un enlace simbólico • https://compass-security.com/fileadmin/Research/Advisories/2020-18_CSNC-2020-030_Amaze_FileManager_Privilege_Escalation.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21237 – Git LFS can execute a Git binary from the current directory on Windows
https://notcve.org/view.php?id=CVE-2021-21237
15 Jan 2021 — Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems. This is the result of an incomplete fix for CVE-2020-27955. This issue occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory se... • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27955 • CWE-426: Untrusted Search Path •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-22550
https://notcve.org/view.php?id=CVE-2020-22550
04 Jan 2021 — Veno File Manager 3.5.6 is affected by a directory traversal vulnerability. Using the traversal allows an attacker to download sensitive files from the server. Veno File Manager versiones 3.5.6, está afectado por una vulnerabilidad de salto de directorios. El uso del salto permite a un atacante descargar archivos confidenciales desde el servidor. • https://codecanyon.net/item/veno-file-manager-host-and-share-files/6114247 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •