Tecrail Responsive_filemanager
20 CVEs affecting Tecrail Responsive_filemanager. Latest disclosed: 2023-06-28. Critical: 4, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-44276 | Critical | 9.8 | 2023-06-28 | In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE. |
CVE-2020-10567 | Critical | 9.8 | 2020-03-14 | An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validati… |
CVE-2020-10212 | Critical | 9.8 | 2020-03-07 | upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possib… |
CVE-2018-14728 | Critical | 9.8 | 2018-08-03 | upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter. |
CVE-2022-46604 | High | 8.8 | 2023-02-02 | An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leadin… |
CVE-2018-18867 | High | 8.6 | 2018-10-31 | An SSRF issue was discovered in tecrail Responsive FileManager 9.13.4 via the upload.php url parameter. NOTE: this issue exists because of an incomplete fix fo… |
CVE-2018-20795 | High | 7.5 | 2019-02-25 | tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary files via path traversal with the path parameter, through the copy_cut action i… |
CVE-2018-20794 | High | 7.5 | 2019-02-25 | tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary image file (jpg/jpeg/png) via path traversal with the path parameter, th… |
CVE-2018-20793 | High | 7.5 | 2019-02-25 | tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass, th… |
CVE-2018-20792 | High | 7.5 | 2019-02-25 | tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary file via path traversal with the path parameter, through the get_file action in… |
CVE-2018-20790 | High | 7.5 | 2019-02-25 | tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass throu… |
CVE-2018-20789 | High | 7.5 | 2019-02-25 | tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary directory as a consequence of a paths[0] path traversal mitigation bypass… |
CVE-2018-18061 | High | 7.5 | 2018-10-10 | An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. Attackers can access the file manager interface that provides them with the abil… |
CVE-2018-15535 | High | 7.5 | 2018-08-24 | /filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted dire… |
CVE-2018-15495 | High | 7.5 | 2018-08-18 | /filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec c… |
CVE-2017-20145 | Medium | 6.3 | 2022-07-25 | A vulnerability was found in Tecrail Responsive Filemanger up to 9.10.x and classified as critical. The manipulation leads to path traversal. The attack may be… |
CVE-2020-11106 | Medium | 6.1 | 2020-03-30 | An issue was discovered in Responsive Filemanager through 9.14.0. In the dialog.php page, the session variable $_SESSION['RF']["view_type"] wasn't sanitized if… |
CVE-2018-20791 | Medium | 6.1 | 2019-02-25 | tecrail Responsive FileManager 9.13.4 allows XSS via a media file upload with an XSS payload in the name, because of mishandling of the media_preview action. |
CVE-2018-18062 | Medium | 6.1 | 2018-10-10 | An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. A reflected XSS vulnerability allows remote attackers to inject arbitrary web sc… |
CVE-2018-15536 | Medium | 5.5 | 2018-08-24 | /filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in archives, allowing for the extraction of c… |