PT-2022-24915 · Unknown · Gin-Vue-Admin

Name of the Vulnerable Software and Affected Versions: Gin-vue-admin versions prior to 2.5.4 Description: Gin-vue-admin is a backstage management system based on vue and gin. The system is vulnerable to path traversal, which leads to file upload vulnerabilities. This vulnerability allows maliciou...

Badaso 代码问题漏洞

Badaso is an open source Laravel Vue headless CMS from Uasoft Open Source. A security vulnerability exists in Badaso version 2.6.0 that stems from the application not properly validating user uploaded data, allowing an unauthenticated remote attacker to remotely execute arbitrary code on the serv...

Backdoor.Win32.Delf.arh MVID-2022-0650 Authentication Bypass

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/b3b19524967d22d6eb7517b03b660b00.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Delf.arh Vulnerability: Authentication Bypass Description: The malware runs...

Simple Exam Reviewer Management System 代码问题漏洞

Simple Exam Reviewer Management System is a Simple Exam Reviewer Management System by Carlo Montero Personal Developer. A security vulnerability exists in Simple Exam Reviewer Management System that originates from vulnerability to unsecured file uploads...

CVE-2022-3126

The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to make logged in users upload files on their behalf...

CVE-2022-42029

Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web directory...

CVE-2022-42029

Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web directory...

PT-2022-26210 · Chamilo · Chamilo

Name of the Vulnerable Software and Affected Versions: Chamilo version 1.11.16 Description: The issue allows authenticated users with access to 'big file uploads' to copy or move files from anywhere in the file system into the web directory. This is due to an authenticated local file inclusion...

Gin-Vue-Admin 代码问题漏洞

Gin-Vue-Admin is a full-stack pre-development infrastructure platform based on Vue and Gin development. A code issue vulnerability exists in Gin-Vue-Admin versions v2.5.1 through v2.5.3b, which stems from not restricting file upload functionality. An attacker exploiting this vulnerability could...

Simple Cold Storage Management System 代码问题漏洞

Simple Cold Storage Management System is a Simple Cold Storage Management System by Carlo Montero Personal Developer. A security vulnerability exists in Simple Cold Storage Management System version 1.0, which stems from the lack of restriction on user uploads...

BoxBilling 代码问题漏洞

BoxBilling is open source billing and customer management software from the individual developers of BoxBilling. A security vulnerability exists in BoxBilling versions prior to 0.0.1 that stems from not restricting the upload of dangerous types of files...

WordPress plugin Profile Builder 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

Amazon Linux AMI : libapreq2 (ALAS-2022-1637)

The version of libapreq2 installed on the remote host is prior to 2.13-38.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1637 advisory. A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A...

netty: world readable temporary file containing sensitive data

CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled...

keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console

A flaw was found in keycloak. The vulnerability allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOADSCRIPTS feature is disabled...

UBUNTU-CVE-2022-3125

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and achieve RCE...

UBUNTU-CVE-2022-3124

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server...

WordPress plugin Frontend File Manager 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plug-in. WordPress Frontend File Manager versions prior to 21.3 are vulnerable to arbitrary file uploads, whi...

PT-2022-21787

Name of the Vulnerable Software and Affected Versions Inventree versions prior to 0.8.3 Description The issue is related to stored Cross-site Scripting XSS in the GitHub repository inventree/inventree. This occurs by uploading SVG files, allowing for the storage of malicious scripts that can be...

CVE-2022-37346

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative...