CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-11106
https://notcve.org/view.php?id=CVE-2020-11106
An issue was discovered in Responsive Filemanager through 9.14.0. In the dialog.php page, the session variable $_SESSION['RF']["view_type"] wasn't sanitized if it was already set. This made stored XSS possible if one opens ajax_calls.php and uses the "view" action and places a payload in the type parameter, and then returns to the dialog.php page. This occurs because ajax_calls.php was also able to set the $_SESSION['RF']["view_type"] variable, but there it wasn't sanitized. Se detectó un problema en Responsive Filemanager versiones hasta 9.14.0. • https://github.com/trippo/ResponsiveFilemanager/issues/603 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-10567 – ZwiiCMS 12.2.04 Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-10567
An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validation of what kind of extension is sent. This makes it possible to execute PHP code if a legitimate JPEG image contains this code in the EXIF data, and the .php extension is used in the name parameter. (A potential fast patch is to disable the save_img action in the config file.) Se detectó un problema en Responsive Filemanager versiones hasta 9.14.0. • http://packetstormsecurity.com/files/171280/ZwiiCMS-12.2.04-Remote-Code-Execution.html https://github.com/trippo/ResponsiveFilemanager/issues/600 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-10212
https://notcve.org/view.php?id=CVE-2020-10212
upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF attempt may succeed if a .ico filename is added to the PATH_INFO. Also, an attacker could create a DNS hostname that resolves to the 0.0.0.0 IP address for DNS pinning. NOTE: this issue exists because of an incomplete fix for CVE-2018-14728. El archivo upload.php en Responsive FileManager versiones 9.13.4 y 9.14.0, permite un ataque de tipo SSRF por medio del parámetro url porque el bloqueo de la extensión de archivo se maneja inapropiadamente y porque es posible que un nombre de host DNS se resuelva en una dirección IP interna. • https://github.com/trippo/ResponsiveFilemanager/issues/598 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 1CVE-2018-20792
https://notcve.org/view.php?id=CVE-2018-20792
tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary file via path traversal with the path parameter, through the get_file action in ajax_calls.php. tecrail Responsive FileManager 9.13.4 permite que los atacantes remotos lean archivos arbitrarios mediante un salto de directorio con el parámetro "path" mediante la acción get_file en ajax_calls.php. • https://www.exploit-db.com/exploits/45987 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20790
https://notcve.org/view.php?id=CVE-2018-20790
tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass through the delete_file action in execute.php. tecrail Responsive FileManager 9.13.4 permite que los atacantes remotos eliminen un archivo arbitrario como consecuencia de una omisión de la mitigación del salto de directorio de paths[0] mediante la acción delete_file en execute.php. • https://www.exploit-db.com/exploits/45987 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •