Vulnerabilities (CVE)

Filtered by CWE-98
Total 25 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2019-5479 1 Larvit 1 Larvitbase 2020-10-16 5.0 MEDIUM 7.5 HIGH
An unintended require vulnerability in <v0.5.5 larvitbase-api may allow an attacker to load arbitrary non-production code (JavaScript file).
CVE-2020-13175 1 Teradici 2 Cloud Access Connector, Cloud Access Connector Legacy 2020-08-14 5.0 MEDIUM 7.5 HIGH
The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 and earlier for Cloud Access Connector) contains a local file inclusion vulnerability which allows an unauthenticated remote attacker to leak LDAP credentials via a specially crafted HTTP request.
CVE-2017-14095 1 Trendmicro 1 Smart Protection Server 2019-10-09 6.8 MEDIUM 8.1 HIGH
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a local file inclusion on a vulnerable system.
CVE-2016-6565 1 Imagely 1 Nextgen Gallery 2019-10-09 6.0 MEDIUM 7.5 HIGH
The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary files from the server, or execute arbitrary code on the server in some circumstances (dependent on server configuration).
CVE-2014-9186 1 Honeywell 1 Experion Process Knowledge System 2019-10-09 7.5 HIGH 9.8 CRITICAL
A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to accepting an arbitrary file into the function, and potential information disclosure or remote code execution. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.