CVE-2021-38847

S-Cart v6.4.1 and below was discovered to contain an arbitrary file upload vulnerability in the Editor module on the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted IMG file...

Design/Logic Flaw

S-Cart v6.4.1 and below was discovered to contain an arbitrary file upload vulnerability in the Editor module on the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted IMG file...

CVE-2021-38847

CVE-2021-38847 affects S-Cart v6.4.1 and earlier. The vulnerability is an arbitrary file upload in the Editor module of the Admin panel, where a crafted IMG file can lead to arbitrary code execution. This is a server-side issue tied to file upload handling in the Editor component. The connected s...

CVE-2021-38847

S-Cart v6.4.1 and below was discovered to contain an arbitrary file upload vulnerability in the Editor module on the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted IMG file...

CVE-2021-38847

S-Cart v6.4.1 and below was discovered to contain an arbitrary file upload vulnerability in the Editor module on the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted IMG file...

S-cart 代码问题漏洞

S-cart, a Php-based e-commerce management platform from the S-cart community, is vulnerable in S-Cart v6.4.1 and below, which can be exploited by attackers to execute arbitrary code via a crafted IMG file...

PT-2021-22297

Name of the Vulnerable Software and Affected Versions S-Cart versions 6.4.1 and below Description The issue is related to an arbitrary file upload vulnerability in the Editor module on the Admin panel. This allows attackers to execute arbitrary code via a crafted IMG file. Recommendations For...

CVE-2021-38847: Unrestricted Upload of File with Dangerous Type

S-Cart v6.4.1 and below was discovered to contain an arbitrary file upload vulnerability in the Editor module on the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted IMG file...

s-credit.info Improper Access Control vulnerability OBB-2202659

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2021-5357

Name of the Vulnerable Software and Affected Versions vim affected versions not specified Description The issue is related to a heap-based buffer overflow in the vim editor, which can be exploited by a remote attacker to execute arbitrary commands. This can be achieved by using the -s parameter i...

S-CMS XML External Entity Injection Vulnerability

S-CMS is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise to provide solutions to build a station of the product. S-CMS 3.0 version of the /api/notify.php exists XML external entity injection vulnerability. An attacker can use this vulnerability to read arbitrary files...

CVE-2020-19954

An XML External Entity XXE vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files...

Xxe

An XML External Entity XXE vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files...

CVE-2020-19954

An XML External Entity XXE vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files...

CVE-2020-19954

CVE-2020-19954 : An XML External Entity (XXE) vulnerability affects S-CMS 3.0, specifically the /api/notify.php endpoint, enabling an attacker to read arbitrary files. Root cause: XXE in XML processing. Documented impact across sources (NVD, CNVD, Red Hat). CVSS v3.1 base score 7.5 (HIGH); CVSS v...

PT-2021-10423

Name of the Vulnerable Software and Affected Versions: S-CMS version 3.0 Description: An XML External Entity XXE issue was found in the "api/notify.php" endpoint, allowing attackers to read arbitrary files. This could potentially lead to sensitive information disclosure. Recommendations: For S-CM...

CVE-2020-19954: Improper Restriction of XML External Entity Reference

An XML External Entity XXE vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files...

Command injection

A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant IAP versions: 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3...

KB5006732: Windows Server 2012 Security Update (October 2021)

The remote Windows host is missing security update 5006732. It is, therefore, affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself i...

Security Updates for Internet Explorer (October 2021)

The Internet Explorer installation on the remote host is missing a security update. It is, therefore, affected by a remote code execution vulnerability in the MSHTML platform. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. %NASLMINLEV...