| Package | Affected versions | Patched versions |
|---|---|---|
| viaware | ≤ 2021-08 |
KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). NOTE: this issue exists because of an incomplete fix for CVE-2019-17124.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free