NewPipe 安全漏洞

NewPipe is a Team NewPipe open source Android application written in Java for video streaming. A security vulnerability exists in NewPipe versions 0.13.4 through 0.26.1, which stems from the fact that importing a backup file from an untrusted source may result in arbitrary code execution...

CVE-2023-43825

Relative path traversal vulnerability in Shihonkanri Plus Ver9.0.3 and earlier allows a local attacker to execute an arbitrary code by having a legitimate user import a specially crafted backup file of the product...

PT-2023-29002 · Unknown · Shihonkanri Plus

Name of the Vulnerable Software and Affected Versions: Shihonkanri Plus versions prior to 9.0.3 Description: A relative path traversal issue allows a local attacker to execute arbitrary code by having a legitimate user import a specially crafted backup file of the product. Recommendations: For...

Shihonkanri Plus Path Traversal Vulnerability

Ekakin Shihonkanri Plus GOOUT is a CGI Public Gateway Interface from Ekakin Japan. A path traversal vulnerability exists in Shihonkanri Plus Ver9.0.3 and earlier versions that could allow a local attacker to execute arbitrary code by allowing a legitimate user to import a specially crafted produc...

CVE-2022-30075

In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation...

CVE-2022-30075

In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation...

CVE-2022-0246

The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one...

CVE-2022-0246

The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one...

CVE-2021-24307

The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseotoolssettings" privilege most of the time admin to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup...

CVE-2020-24046

A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the operating system. This restricted shell can be bypassed after changing the properties of the user admin in the operating...

CVE-2020-24046: Improper Privilege Management

A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the operating system. This restricted shell can be bypassed after changing the properties of the user admin in the operating...

PT-2020-15627

Name of the Vulnerable Software and Affected Versions TitanHQ SpamTitan Gateway version 7.07 Description A sandbox escape issue allows an authenticated attacker to bypass the restricted shell and gain root access. The restricted shell limits the admin user to executing a small number of tools...

TurboMail邮箱系统越权读取任意文件、导入备份等（可读取任意用户及管理员密码等）

简要描述： TurboMail邮箱系统越权读取任意文件（可读取管理员密码等） 详细说明： http://localhost/tmw/8/viewfile/account.xml?type=gl&logtype=../../turbomail/accounts/root/postmaster（你想要读密码的用户名）&sessionid=此处需普通用户sessionid 可以读取任意用户密码 此处导入的是zip文件，会自动解压，你也可以导入你上传的其他文件，如图片后缀的zip也可以解压...