Security Vulnerabilities Related To CWE-538

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2021-21250	538		2021-01-15	2021-01-21	4.0	None	Remote	Low	???	Partial	None	None
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by XmlBuildSpecMigrator.migrate(buildSpecString); which processes the XML document without preventing the expansion of external entities. These entities can be configured to read arbitrary files from the file system and dump their contents in the final XML document to be migrated. If the files are dumped in properties included in the YAML file, it will be possible for an attacker to read them. If not, it is possible for an attacker to exfiltrate the contents of these files Out Of Band. This issue was addressed in 4.0.3 by ignoring ENTITY instructions in xml file.
2	CVE-2021-1406	538	+Info	2021-04-08	2022-01-05	4.0	None	Remote	Low	???	Partial	None	None
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper inclusion of sensitive information in downloadable files. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a specific set of commands. A successful exploit could allow the attacker to obtain hashed credentials of system users. To exploit this vulnerability an attacker would need to have valid user credentials with elevated privileges.
3	CVE-2019-12623	538		2019-08-21	2019-10-09	4.0	None	Remote	Low	???	Partial	None	None
A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server responding with different error codes for existing and non-existing files. An attacker could exploit this vulnerability by sending GET requests for different file names. A successful exploit could allow the attacker to enumerate files residing on the system.
4	CVE-2019-10320	538		2019-05-21	2019-06-11	4.0	None	Remote	Low	???	Partial	None	None
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
5	CVE-2018-20932	538		2019-08-01	2019-08-12	4.0	None	Remote	Low	???	Partial	None	None
cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406).
6	CVE-2018-16970	538		2018-09-12	2018-11-21	4.0	None	Remote	Low	???	Partial	None	None
Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to download non-purchased course files via a modified id parameter.
7	CVE-2018-11798	538		2019-01-07	2019-06-19	4.0	None	Remote	Low	???	Partial	None	None
The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.
8	CVE-2018-10590	538		2018-05-15	2019-10-09	5.0	None	Remote	Low	Not required	Partial	None	None
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an information exposure vulnerability through directory listing has been identified, which may allow an attacker to find important files that are not normally visible.
9	CVE-2017-5387	538		2018-06-11	2018-08-07	2.1	None	Local	Low	Not required	None	Partial	None
The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "source" attribute on a "<track>" tag refers to a file that does not exist if the source page is loaded locally. This vulnerability affects Firefox < 51.
10	CVE-2016-10399	538	File Inclusion	2017-07-27	2017-08-07	5.0	None	Remote	Low	Not required	Partial	None	None
Sendio versions before 8.2.1 were affected by a Local File Inclusion vulnerability that allowed an unauthenticated, remote attacker to read potentially sensitive system files via a specially crafted URL.

Total number of vulnerabilities : 10 Page : 1 (This Page)