Tecrail

Responsive Filemanager

20 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2018-20791

Exploit
  • EPSS 0.33%
  • Veröffentlicht 25.02.2019 06:29:00
  • Zuletzt bearbeitet 21.11.2024 04:02:11

tecrail Responsive FileManager 9.13.4 allows XSS via a media file upload with an XSS payload in the name, because of mishandling of the media_preview action.

7.5

CVE-2018-20790

Exploit
  • EPSS 0.63%
  • Veröffentlicht 25.02.2019 06:29:00
  • Zuletzt bearbeitet 21.11.2024 04:02:10

tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass through the delete_file action in execute.php.

7.5

CVE-2018-20789

Exploit
  • EPSS 0.63%
  • Veröffentlicht 25.02.2019 06:29:00
  • Zuletzt bearbeitet 21.11.2024 04:02:10

tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary directory as a consequence of a paths[0] path traversal mitigation bypass through the delete_folder action in execute.php.

8.6

CVE-2018-18867

Exploit
  • EPSS 0.37%
  • Veröffentlicht 31.10.2018 05:29:00
  • Zuletzt bearbeitet 21.11.2024 03:56:46

An SSRF issue was discovered in tecrail Responsive FileManager 9.13.4 via the upload.php url parameter. NOTE: this issue exists because of an incomplete fix for CVE-2018-15495.

6.1

CVE-2018-18062

Exploit
  • EPSS 0.22%
  • Veröffentlicht 10.10.2018 21:29:02
  • Zuletzt bearbeitet 21.11.2024 03:55:25

An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. A reflected XSS vulnerability allows remote attackers to inject arbitrary web script or HTML.

7.5

CVE-2018-18061

Exploit
  • EPSS 0.2%
  • Veröffentlicht 10.10.2018 21:29:02
  • Zuletzt bearbeitet 21.11.2024 03:55:24

An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. Attackers can access the file manager interface that provides them with the ability to upload and delete files.

5.8

CVE-2018-15536

Exploit
  • EPSS 6.62%
  • Veröffentlicht 24.08.2018 19:29:01
  • Zuletzt bearbeitet 21.11.2024 03:51:01

/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in archives, allowing for the extraction of crafted archives to overwrite arbitrary files via an extract action, aka Directory Traversal...

7.5

CVE-2018-15535

Exploit
  • EPSS 81.25%
  • Veröffentlicht 24.08.2018 19:29:01
  • Zuletzt bearbeitet 21.11.2024 03:51:01

/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize get_file sequences such as ".." that can resolve...

7.5

CVE-2018-15495

Exploit
  • EPSS 0.39%
  • Veröffentlicht 18.08.2018 02:29:01
  • Zuletzt bearbeitet 21.11.2024 03:50:56

/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value.

9.8

CVE-2018-14728

Exploit
  • EPSS 90.73%
  • Veröffentlicht 03.08.2018 18:29:00
  • Zuletzt bearbeitet 21.11.2024 03:49:41

upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.