1578 matches found
WordPress plugin Domain Replace 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Domain Replace plugin, which stems from the...
Craft CMS PHP Code Injection Vulnerability
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets-Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension...
RubyGems 安全漏洞
RubyGems is a Ruby package manager from the RubyGems organization. The product is primarily used to distribute and manage Ruby packages. RubyGems suffers from a security vulnerability that stems from an error in yank operations, which allows any RubyGems.org user to delete and replace certain gem...
WordPress Better Find and Replace plugin <= 1.3.4 - SQL Injection (SQLi) vulnerability
SQL Injection SQLi vulnerability discovered in WordPress Better Find and Replace plugin versions = 1.3.4. Solution Update the WordPress Better Find and Replace plugin to the latest available version at least 1.3.5...
WordPress Domain Replace plugin <= 1.3.8 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Domain Replace plugin versions = 1.3.8. Solution Deactivate and delete. This plugin has been closed as of April 4, 2022 and is not available for download. This closure is temporary, pending a full review...
Domain Replace <= 1.3.8 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=dr-convert=%3Csvg%2Fonload%3Dalert%28%2Fxss%2F%29%3E...
Domain Replace <= 1.3.8 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=dr-convert&msg=%3Csvg%2Fonload%3Dalert%28%2Fxss%2F%29%3E...
CVE-2022-26839: Incorrect Default Permissions
Delta Electronics DIAEnergie All versions prior to 1.8.02.004 is vulnerable to an incorrect default permission in the DIAEnergie application, which may allow an attacker to plant new files such as DLLs or replace existing executable files...
Delta Electronics DIAEnergie 安全漏洞
Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.An authorization...
CLSA-2022-1645466687 Fix of CVE: CVE-2021-28153, CVE-2021-3800
CVE-2021-28153: gfilereplace with GFILECREATEREPLACEDESTINATION creates empty target for dangling symlink 1939118 - CVE-2021-3800: Possible privilege escalation thourgh pkexec and aliases 1938284...
PT-2022-7246
Name of the Vulnerable Software and Affected Versions Emerson Dixell XWEB-500 affected versions not specified Description The issue is related to information disclosure via directory listing, allowing a potential attacker to access all files in remote directories. This is due to a misconfiguratio...
glib: g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION creates empty target for dangling symlink
An issue was discovered in GNOME GLib before 2.66.8. When gfilereplace is used with GFILECREATEREPLACEDESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is...
kernel: lack a full memory barrier upon the assignment of a new table value in net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h may lead to DoS
A denial-of-service DoS flaw was identified in the Linux kernel due to an incorrect memory barrier in xtreplacetable in net/netfilter/xtables.c in the netfilter subsystem...
CVE-2021-37364
OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A low privilege account is able to rename mysqld.exe or tomcat8.exe files located in bin folders and replace with a malicious file that would...
CVE-2021-37364
OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A low privilege account is able to rename mysqld.exe or tomcat8.exe files located in bin folders and replace with a malicious file that would...
CVE-2021-38485
The affected product is vulnerable to improper input validation in the restore file. This enables an attacker to provide malicious config files to replace any file on disk...
CVE-2021-38485: Improper Input Validation
The affected product is vulnerable to improper input validation in the restore file. This enables an attacker to provide malicious config files to replace any file on disk...
Emerson WirelessHART Gateway 输入验证错误漏洞
The Emerson WirelessHART Gateway is a wireless gateway from Emerson USA. The Emerson WirelessHART Gateway has an input validation error vulnerability that stems from the susceptibility of the affected product to incorrect input validation in a restore file. This allows an attacker to provide a...
kernel: out-of-bounds write in xt_compat_target_from_user() in net/netfilter/x_tables.c
A flaw was discovered in processing setsockopt IPTSOSETREPLACE or IP6TSOSETREPLACE for 32 bit processes on 64 bit systems. This flaw will allow local user to gain privileges or cause a DoS through user name space. This action is usually restricted to root-privileged users but can also be leverage...
kernel: out-of-bounds write in xt_compat_target_from_user() in net/netfilter/x_tables.c
A flaw was discovered in processing setsockopt IPTSOSETREPLACE or IP6TSOSETREPLACE for 32 bit processes on 64 bit systems. This flaw will allow local user to gain privileges or cause a DoS through user name space. This action is usually restricted to root-privileged users but can also be leverage...