NetIQ iManager 代码问题漏洞

NetIQ iManager is an advanced web-based management console from NetIQ UK. Provides customized, secure access to network management utilities and content from any location in the world. A security vulnerability exists in NetIQ iManager version 3.2.6.0200 that stems from the presence of a file uplo...

Baizhuo Network Smart s200 Management Platform 代码问题漏洞

Baizhuo Network Smart s200 Management Platform is a network management platform from Baizhuo, China. A code issue vulnerability exists in Baizhuo Network Smart s200 Management Platform version 20240507 and prior versions, which stems from an incorrect operation of the parameter webimg that can le...

PT-2024-40218 · Ez Systems +1 · Ez Publish Legacy +2

Name of the Vulnerable Software and Affected Versions: eZ Platform and eZ Publish Legacy affected versions not specified Description: The issue concerns a vulnerability in the way eZ Platform and eZ Publish Legacy handle file uploads, potentially leading to remote code execution RCE if an attacke...

PT-2024-40367 · Unknown +1 · Archive Tar +1

Name of the Vulnerable Software and Affected Versions: Drupal versions prior to the latest version that updates Archive Tar to 1.4.9 Description: The issue arises from the use of the third-party library Archive Tar, which has released a security improvement. Multiple vulnerabilities are possible ...

Z-Downloads < 1.11.4 - Authenticated (Admin+) Arbitrary File Upload

Description The Z-Downloads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.11.3. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on th...

CVE-2024-4487

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2.0.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and...

CVE-2024-4487

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2.0.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and...

CVE-2024-4397

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepostmaterials' function in versions up to, and including, 4.2.6.5. This makes it possible for authenticated attackers, with Instructor-level permissio...

Siemens RUGGEDCOM CROSSBOW 安全漏洞

Siemens RUGGEDCOM CROSSBOW is a proven secure access management solution from Siemens, Germany. Siemens RUGGEDCOM CROSSBOW suffers from a privilege miss vulnerability that could cause an unauthenticated user to upload arbitrary files, which could be exploited by an attacker to execute arbitrary...

WordPress plugin Blocksy Companion 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Open Source Clinic Management System 代码问题漏洞

BigProf Online Clinic Management System is an online clinic management system from BigProf, Inc. A code issue vulnerability exists in Open Source Clinic Management System version 1.0, which stems from the parameter logo in the file setting.php that can lead to unrestricted uploads...

WordPress plugin canvasio3D Light 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

WordPress plugin Kognetiks Chatbot 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin LearnPress 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Online Computer and Laptop Store 代码问题漏洞

Online Computer and Laptop Store is an online computer and laptop store by Carlo Montero Personal Developer. A code issue vulnerability exists in Online Computer and Laptop Store version 1.0, which stems from the file /classes/SystemSettings.php?f=updatesettings causing unrestricted uploads...

Siemens RUGGEDCOM CROSSBOW 安全漏洞

Siemens RUGGEDCOM CROSSBOW is a proven secure access management solution from Siemens, Germany. Siemens RUGGEDCOM CROSSBOW suffers from a File Name or Path External Control vulnerability due to an affected system allowing a privileged user to upload generic files to the root installation director...

WordPress Blocksy Companion plugin <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via SVG Uploads vulnerability discovered by wesley wcraft in WordPress Plugin Blocksy Companion versions = 2.0.45...

PT-2024-24787 · Kognetiks · Kognetiks Chatbot For Wordpress

Name of the Vulnerable Software and Affected Versions: Kognetiks Chatbot for WordPress versions n/a through 2.0.0 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects the Kognetiks Chatbot for WordPress. This allows for the upload of files with...

CVE-2024-4487

CVE-2024-4487 affects Blocksy Companion for WordPress. The vulnerability is a Stored Cross-Site Scripting via SVG uploads in Blocksy Companion versions up to and including 2.0.45, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at contribu...

CVE-2024-4560

CVE-2024-4560 affects the Kognetiks Chatbot for WordPress plugin. It reveals unauthenticated arbitrary file upload via chatbot_chatgpt_upload_file_to_assistant, in all versions up to 1.9.9, due to missing file-type validation. This could lead to remote code execution on the affected site. A patch...