133 matches found
CVE-2023-2180
creationtimestamp| type| source ---|---|--- 2023-05-15 16:43:23+00:00| seen| https://t.me/cibsecurity/64130 2025-01-24 21:05:21+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/3027...
CVE-2023-2180
The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization assuming they can upload a file on the server...
CVE-2023-2180 KIWIZ Invoices Certification & PDF System <= 2.1.3 - Unauthenticated Arbitrary File Download
The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization assuming they can upload a file on the server...
CVE-2023-2180 KIWIZ Invoices Certification & PDF System <= 2.1.3 - Unauthenticated Arbitrary File Download
The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization assuming they can upload a file on the server...
CVE-2023-2180
The CVE-2023-2180 entry concerns the KIWIZ Invoices Certification & PDF System WordPress plugin (versions ≤ 2.1.3). Affected component: file download path validation is insufficient, enabling an unauthenticated attacker to read/download arbitrary files. The issue also enables PHAR unserialization...
WordPress KIWIZ Invoices Certification & PDF System Plugin <= 2.1.3 is vulnerable to Arbitrary File Download
Software KIWIZ Invoices Certification & PDF System Type Plugin Vulnerable versions = 2.1.3 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Download CVE CVE-2023-2180 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID daccef4ee9c6 Credits WPScan Required...
openssl security update
1.0.1e-59.0.4 - Backport fixes for CVE-2023-0286 Orabug: 35212597 1.0.1e-59.0.3 - Fix possible infinite loop in BNmodsqrt CVE-2022-0778Orabug: 33969800 1.0.1e-59.0.1 - Backport fixes for CVE-2020-1971 Orabug: 32654738 1.0.1e-58.0.1 - Oracle bug 28730228: backport CVE-2018-0732 - Oracle bug...
Debian: Security Advisory (DLA-637-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Amazon Linux AMI : mysql57 (ALAS-2023-1686)
The version of mysql57 installed on the remote host is prior to 5.7.41-1.18. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1686 advisory. 2023-06-07: CVE-2023-21963 was added to this advisory. Vulnerability in the MySQL Server product of Oracle MySQL...
Medium: mysql57
Issue Overview: 2023-06-07: CVE-2023-21963 was added to this advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Connection Handling. Supported versions that are affected are 5.7.40 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high...
SUSE CVE-2010-2180
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service memory corruption or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-2160, CVE-2010-2165, CVE-2010-2166,...
SUSE CVE-2015-2180
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password...
Security Bulletin: Multiple Security Vulnerabilities exist in IBM Cognos Express.
Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition Version 7 that is used by IBM Cognos Express. This issue was disclosed as part of the IBM Java SDK updates in July 2016. OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by IBM Cogn...
CVE-2022-2180 GREYD.SUITE < 1.2.7 - Unauthenticated File Upload to RCE
The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution RCE...
CVE-2022-2180
The CVE-2022-2180 issue affects the GREYD.SUITE WordPress theme and related listings, where unauthenticated users can upload arbitrary files (including PHP) via the theme’s custom font upload workflow due to missing authorization/CSRF checks. This can lead to remote code execution (RCE). Affected...
SUSE SLES12 Security Update : openssl (SUSE-SU-2022:2180-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2180-1 advisory. - In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not...
Security Bulletin: Multiple vulnerabilities in OpenSSL affects IBM InfoSphere Master Data Management
Summary IBM Initiate Master Data Service and IBM InfoSphere Master Data Management are vulnerable to multiple OpenSSL denial of service attacks and could allow access to sensitive information. Vulnerability Details CVEID: CVE-2016-2177 DESCRIPTION: OpenSSL is vulnerable to a denial of service,...
Security Bulletin: Multiple Security Vulnerabilities in OpenSSL affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center)
Summary OpenSSL vulnerabilities were disclosed on September 22 and September 26, 2016 by the OpenSSL Project. OpenSSL is used by IBM Spectrum Control and Tivoli Storage Productivity Center. IBM Spectrum Control and Tivoli Storage Productivity Center have addressed the applicable CVEs. Vulnerabili...
Mageia: Security Advisory (MGASA-2016-0338)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...