Priority LOW 39
DEXT5 Upload 5.0.0.117 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argument, variable in the activeX module.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00626 · Published 2021-10-28 · No fix listed CWE-494
Priority MEDIUM 44
A vulnerability (improper input validation) in the DEXT5 Upload solution allows an unauthenticated attacker to download and execute an arbitrary file via AddUploadFile, SetSelectItem, DoOpenFile function.(CVE-2020-7832)
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00952 · Published 2021-09-07 · No fix listed CWE-20
Priority MEDIUM 41
A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01477 · Published 2021-08-05 · Fixed in 2018.0.2.56 CWE-20
Priority LOW 34
An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers to perform a DLL hijacking attack when the service or system is restarted.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00458 · Published 2021-07-14 · No fix listed CWE-427
Priority MEDIUM 44
Parameter manipulation can bypass authentication to cause file upload and execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00956 · Published 2021-06-15 · Fixed in 3.5.1405747.1100.03 CWE-434
Priority LOW 35
RAONWIZ v2018.0.2.50 and earlier versions contains a vulnerability that could allow remote files to be downloaded by lack of validation.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00798 · Published 2020-09-02 · No fix listed CWE-20
Priority LOW 34
MyBrowserPlus downloads the files needed to run the program through the setup file (Setup.inf).
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0028 · Published 2020-08-06 · No fix listed CWE-494
Priority MEDIUM 44
RAONWIZ v2018.0.2.50 and eariler versions contains a vulnerability that could allow remote files to be downloaded and excuted by lack of validation to file extension, witch can used as remote-code-excution attacks by hac…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01151 · Published 2020-07-10 · Fixed in 2018.0.2.51 CWE-20
Priority MEDIUM 43
In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments which causes downloading a random DLL and injection on it.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00689 · Published 2020-05-21 · No fix listed CWE-353
Priority LOW 39
dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00773 · Published 2020-05-07 · No fix listed CWE-20
Priority MEDIUM 45
Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0161 · Published 2020-05-06 · Fixed in 5.0.0.117
Priority MEDIUM 45
Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by setting the arguments to the activex method.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0161 · Published 2020-05-06 · Fixed in 5.0.0.117