rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-13377 
The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of observable timing differences and cache access patterns when Brainpool curves are used. An attacker may be able to gain leaked information from a side-channel attack that can be used for full password recovery.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-15T16:05:29.000Z
CVE-2019-13379 
On AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device's web interface may escalate privileges from an unauthenticated user to administrator by performing a cmd.cgi?action=ResetDefaults&src=RA reset and using the default credentials to get in.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-07T15:44:11.000Z
CVE-2019-13380 
KEYNTO Team Password Manager 1.5.0 allows XSS because data saved from websites is mishandled in the online vault.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T20:36:05.000Z
CVE-2019-13382 
UploaderService in SnagIT 2019.1.2 allows elevation of privilege by placing an invalid presentation file in %PROGRAMDATA%\TechSmith\TechSmith Recorder\QueuedPresentations and then creating a symbolic link in %PROGRAMDATA%\Techsmith\TechSmith Recorder\InvalidPresentations that points to an arbitrary folder with an arbitrary file name. TechSmith Relay Classic Recorder prior to 5.2.1 on Windows is vulnerable. The vulnerability was introduced in SnagIT Windows 12.4.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T12:25:19.000Z
CVE-2019-13383 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T16:54:34.000Z
CVE-2019-13385 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T12:05:59.000Z
CVE-2019-13386 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obtain a reverse shell with user privilege.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T12:06:29.000Z
CVE-2019-13387 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers to steal a cookie or session, or redirect to a phishing website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T12:06:57.000Z
CVE-2019-13389 
RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-20T00:00:00.000Z
CVE-2019-13390 
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-07T21:16:28.000Z
CVE-2019-13391 
In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-07T21:16:44.000Z
CVE-2019-13392 
A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that this array is keyed via integers by default, so any string input will be invalid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-15T23:52:24.000Z
CVE-2019-13393 
The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses the same default 8 character passphrase for the administrative console and the WPA2 pre-shared key. Either an attack against HTTP Basic Authentication or an attack against WPA2 could be used to determine this passphrase.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T17:27:33.000Z
CVE-2019-13394 
The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T17:26:17.000Z
CVE-2019-13395 
The Voo branded NETGEAR CG3700b custom firmware V2.02.03 allows CSRF against all /goform/ URIs. An attacker can modify all settings including WEP/WPA/WPA2 keys, restore the router to factory settings, or even upload an entire malicious configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T17:24:30.000Z
CVE-2019-13396 
FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POST request because of an include_once in system_handle_form_submit in modules/system/system.module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-10T13:45:05.000Z
CVE-2019-13397 
Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file extension while creating a support ticket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T16:54:45.000Z
CVE-2019-13398 
Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-08T00:01:43.000Z
CVE-2019-13399 
Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-08T00:01:53.000Z
CVE-2019-13400 
Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-08T00:02:05.000Z
CVE-2019-13401 
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-08T00:02:12.000Z
CVE-2019-13402 
/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-08T00:02:20.000Z
CVE-2019-13403 
Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, leading to the viewing of user information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T16:04:43.000Z
CVE-2019-13404 
The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory, because backwards compatibility requires that C:\Python27 remain the default for 2.7.x
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-08T00:54:41.000Z
CVE-2019-13405 Advan VD-1 allows a remote user to enable Android Debug Bridge without any authentication
A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software.
Problem types: description: Broken access control
Affected products: vendor: AndroVideo
product: Advan VD-1 firmware
Credits: lang: en
value: Keniver Wang (CHT Security)
Published: 2019-08-29T00:19:23.331Z
CVE-2019-13406 Advan VD-1 has a vulnerability that allows remote arbitrary APK installation
A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication.
Problem types: description: Broken access control
Affected products: vendor: AndroVideo
product: Advan VD-1 firmware
Credits: lang: en
value: Keniver Wang (CHT Security)
Published: 2019-08-29T00:19:32.626Z
CVE-2019-13407 Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgi
A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: AndroVideo
product: Advan VD-1 firmware
Credits: lang: en
value: Keniver Wang (CHT Security)
Published: 2019-08-29T00:19:39.243Z
CVE-2019-13408 Advan VD-1 allows users to download arbitrary files
A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: AndroVideo
product: Advan VD-1 firmware
Credits: lang: en
value: Keniver Wang (CHT Security)
Published: 2019-08-29T00:18:52.900Z
CVE-2019-13409 A SQL injection vulnerability was discovered in TOPMeeting before version 8.8 (2019/08/19)
A SQL injection vulnerability was discovered in TOPMeeting before version 8.8 (2019/08/19). An attacker can use a union based injection query string though a search meeting room feature to get databases schema and username/password.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: TOPOO Technology
product: TOPMeeting
Published: 2019-10-17T19:24:35.696Z
CVE-2019-13410 TOPMeeting version before version 8.8 (2019/08/19) allows an attacker to obtain sensitive information
TOPMeeting before version 8.8 (2019/08/19) shows attendees account and password in front end page that allows an attacker to obtain sensitive information by browsing the source code of the page.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: TOPOO Technology
product: TOPMeeting
Published: 2019-10-17T19:25:59.880Z
CVE-2019-13411 A remote command execution vulnerability was discovered in HiNet GPON firmware < I040GWR190731 port 3097
An “invalid command” handler issue was discovered in HiNet GPON firmware < I040GWR190731. It allows an attacker to execute arbitrary command through port 3097. CVSS 3.0 Base score 10.0. CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Problem types: description: execute arbitrary command
Affected products: vendor: HiNET
product: GPON
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: DEVCORE
Published: 2019-10-17T17:42:23.854Z
CVE-2019-13412 A vulnerability was discovered in HiNet GPON firmware < I040GWR190731 that allows an attacker to read arbitrary files
A service which is hosted on port 3097 in HiNet GPON firmware < I040GWR190731 allows an attacker to execute a specific command to read arbitrary files. CVSS 3.0 Base score 9.3. CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L).
Problem types: description: read arbitrary files
Affected products: vendor: HiNET
product: GPON
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: DEVCORE
Published: 2019-10-17T19:21:13.687Z
CVE-2019-13413 
The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-08T13:05:15.000Z
CVE-2019-13414 
The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-08T13:05:24.000Z
CVE-2019-13415 
Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not authorized to see.
Problem types: cwe_id: CWE-280
description: CWE-280: Improper Handling of Insufficient Permissions or Privileges
Affected products: vendor: floragunn
product: Search Guard
Published: 2019-08-13T18:59:59.000Z
CVE-2019-13416 
Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote cluster(s).
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: floragunn
product: Search Guard
Published: 2019-08-13T18:58:45.000Z
CVE-2019-13417 
Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user when field level security (FLS) is activated.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: floragunn
product: Search Guard
Published: 2019-08-12T20:51:23.000Z
CVE-2019-13418 
Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized.
Problem types: cwe_id: CWE-311
description: CWE-311: Missing Encryption of Sensitive Data
Affected products: vendor: floragunn
product: Search Guard
Published: 2019-08-12T21:12:11.000Z
CVE-2019-13419 
Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked.
Problem types: cwe_id: CWE-311
description: CWE-311: Missing Encryption of Sensitive Data
Affected products: vendor: floragunn
product: Search Guard
Published: 2019-08-13T14:28:44.000Z
CVE-2019-13420 
Search Guard versions before 21.0 had an timing side channel issue when using the internal user database.
Problem types: cwe_id: CWE-208
description: CWE-208: Information Exposure Through Timing Discrepancy
Affected products: vendor: floragunn
product: Search Guard
Published: 2019-08-13T14:25:43.000Z
CVE-2019-13421 
Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database.
Problem types: cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
Affected products: vendor: floragunn
product: Search Guard
Credits: lang: en
value: This security vulnerability was found by Torsten Lutz and Oliver Streicher of SySS
GmbH.

E-Mail: torsten.lutz (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Torsten_Lutz.asc
Key Fingerprint: DAB2 86A6 C099 1350 9FCB FB9B 94E8 DC24 BAEC ACC8

E-Mail: oliver.streicher (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Oliver_Streicher.asc
Key Fingerprint: 1973 E30F 7966 F45E CCAB 1BF1 3F08 A35E DCB8 35D6
Published: 2019-08-23T13:26:46.000Z
CVE-2019-13422 
Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially malicious site upon Kibana login.
Problem types: cwe_id: CWE-601
description: CWE-601: URL Redirection to Untrusted Site
cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation
Affected products: vendor: floragunn
product: Search Guard Kibana Plugin
Published: 2019-08-23T13:35:03.000Z
CVE-2019-13423 
Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user when providing wrong credentials when all of the following conditions a-c are true: a) Kibana is configured to use Single-Sign-On as authentication method, one of Kerberos, JWT, Proxy, Client certificate. b) The kibanaserver user is configured to use HTTP Basic as the authentication method. c) Search Guard is configured to use an SSO authentication domain and HTTP Basic at the same time
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: floragunn
product: Search Guard Kibana Plugin
Published: 2019-08-23T13:30:26.000Z
CVE-2019-13445 
An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. parseOptions() in tools/rosbag/src/record.cpp has an integer overflow when a crafted split option can be entered on the command line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T17:54:07.000Z
CVE-2019-13447 
An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could access the backend database via SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T19:14:58.000Z
CVE-2019-13448 
An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could exploit the vulnerable function in order to prepare an XSS payload to send to the product's clients.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T19:14:27.000Z
CVE-2019-13449 
In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service (continual focus grabs) via a sequence of invalid launch?action=join&confno= requests to localhost port 19421.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T05:48:41.000Z
CVE-2019-13450 
In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerable if the Zoom Client was installed in the past and then uninstalled. Blocking exploitation requires additional steps, such as the ZDisableVideo preference and/or killing the web server, deleting the ~/.zoomus directory, and creating a ~/.zoomus plain file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T05:49:07.000Z
CVE-2019-13451 
In Xymon through 4.3.28, a buffer overflow vulnerability exists in history.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T16:37:07.000Z
CVE-2019-13452 
In Xymon through 4.3.28, a buffer overflow vulnerability exists in reportlog.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T16:31:49.000Z
CVE-2019-13453 
Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T14:17:56.000Z
CVE-2019-13454 
ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T16:07:30.000Z
CVE-2019-13455 
In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the alert acknowledgment CGI tool because of &nbsp; expansion in acknowledge.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T16:28:15.000Z
CVE-2019-13456 
In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-03T19:53:53.000Z
CVE-2019-13457 
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search results to disclose information from their "company" tickets (with the same CustomerID), even when the CustomerDisableCompanyTicketAccess setting is turned on.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T17:16:25.000Z
CVE-2019-13458 
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in templates in order to disclose hashed user passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T00:00:00.000Z
CVE-2019-13461 
In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop bug #14444.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T17:33:26.000Z
CVE-2019-13462 
Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T16:30:41.000Z
CVE-2019-13463 
An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because esc_html is not called for the "echo get_the_title()" or "echo $term->name" statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-20T20:40:01.000Z
CVE-2019-13464 
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T18:07:21.000Z