Kun Xian Lin

An Absolute Path Traversal issue allows unauthenticated remote attackers to read file names located under arbitrary paths. Path Traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder.

An Arbitrary File Read issue exists that allows privileged local attackers to use Relative Path Traversal to download arbitrary system files. Relative Path Traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences.

An Arbitrary File Read issue exists that allows unauthenticated local attackers to use Relative Path Traversal—a technique used to access files and directories that are stored outside the web root folder—to download arbitrary files from the system.

An arbitrary file upload flaw allows privileged remote attackers to upload and execute web shell backdoors, enabling arbitrary code execution on the server. A web shell is a malicious script uploaded to a server to allow remote administration and control.

An arbitrary file upload flaw allows unauthenticated remote attackers to upload and execute web shell backdoors, which enables arbitrary code execution on the server.

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Upload issue. This allows remote attackers with specific privileges to upload and execute web shell backdoors, leading to arbitrary code execution on the server.

The underlying Windows OS of the ANCHOR product contains high-privilege service accounts. If these accounts use default passwords, attackers could remotely log in to the virtual machine using the default credentials.

The issue concerns a Path Traversal vulnerability in TRCore's DVC, which does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

The issue concerns a Path Traversal vulnerability in TRCore's DVC, which does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

The issue allows unauthenticated remote attackers to exploit a Path Traversal vulnerability, enabling them to read arbitrary system files. This can lead to unauthorized file access.

The issue allows unauthenticated remote attackers to exploit a Path Traversal vulnerability, enabling them to read arbitrary system files.

The issue concerns a Path Traversal vulnerability in the DVC from TRCore, which also fails to restrict the types of files that can be uploaded. This vulnerability allows unauthenticated remote attackers to upload arbitrary files to any directory. As a result, attackers can achieve arbitrary code execution by uploading webshells.

The issue concerns a Path Traversal vulnerability in the DVC from TRCore, which does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

The issue is related to the improper validation of file types for uploads in the Enterprise Cloud Database from Ragic. Attackers with regular privileges can exploit this by uploading a webshell, which allows them to execute arbitrary code on the remote server.

Name of the Vulnerable Software and Affected Versions: Ragic Enterprise Cloud Database (affected versions not specified) Description: The issue is related to a lack of authentication for a critical function in the Ragic Enterprise Cloud Database, allowing unauthenticated remote attackers to obtain any user's session cookie. This could potentially lead to unauthorized access to sensitive data. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue affects Hgiga OAKlouds, allowing unauthenticated remote attackers to download arbitrary system files, which may then be deleted.

Name of the Vulnerable Software and Affected Versions: OMFLOW from The SYSCOM Group (affected versions not specified) Description: The issue involves the exposure of sensitive data, allowing remote attackers who have logged into the system to obtain password hashes of all users and administrators. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue concerns the file uploading function of SmartStar Software CWS, a web-based integration platform, which does not restrict the upload of files with dangerous types. This allows an unauthenticated remote attacker to upload arbitrary files, potentially leading to the execution of arbitrary commands or disruption of service.

The issue is related to missing authorization in the SmartStar Software CWS web-based integration platform. This allows users to access data or perform actions that they should not be allowed to, via commands. An authenticated user with normal privileges can execute administrator privileges, resulting in the ability to perform arbitrary system operations or disrupt the service.