CVE-2023-6846

The File Manager Pro WordPress plugin (wp-file-manager-pro) is vulnerable to Arbitrary File Upload in versions up to and including 8.3.4 via the mk_check_filemanager_php_syntax AJAX function. Authenticated users with subscriber access can cause server-side code execution. Version 8.3.5 adds a cap...

High Severity Arbitrary File Upload Vulnerability Patched in File Manager Pro WordPress Plugin

On December 14th, 2023, shortly after the launch of our Holiday Bug Extravaganza, we received a submission for an Arbitrary File Upload vulnerability in File Manager Pro, a WordPress plugin with an estimated 10,000+ active installations. This vulnerability made it possible for authenticated...

WordPress File Manager Pro Plugin <= 8.3.4 is vulnerable to Arbitrary File Upload

Software File Manager Pro Type Plugin Vulnerable versions = 8.3.4 Fixed in 8.3.5 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6846 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID f7afa0b6cb70 Credits Tobias Weißhaar kun19 Required privileg...

SUSE CVE-2017-6846

The GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace function in graphicsstack.h in PoDoFo 0.9.4 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted file...

Schneider Electric Modicon Cleartext Transmission of Sensitive Information (CVE-2019-6846)

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules all firmware versions, which could cause information disclosure when using the FTP protocol. This plugin only works with Tenable.ot. Please visit...

CVE-2019-6846

CVE-2019-6846 affects Schneider Electric Modicon M580, M340, BMxCRA and 140CRA modules (all firmware versions). The root cause is use of FTP for credential/command transmission, resulting in cleartext exposure of sensitive information to network observers. Reported impact is information disclosur...

almeria.listado-empresas.es Cross Site Scripting vulnerability

Security Researcher Gh05tPT Helped patch 6846 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting almeria.listado-empresas.es website and its users...

dnk.fordparts.com Cross Site Scripting vulnerability

Security Researcher Gh05tPT Helped patch 6846 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting dnk.fordparts.com website and its users. Following...

CVE-2018-6846

Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zbsystem/function/lib/upload.php...

CVE-2018-6846

CVE-2018-6846 affects Z-BlogPHP 1.5.1 and enables remote attackers to disclose the full server path by directly requesting zb_system/function/lib/upload.php. Multiple sources (Red Hat, NVD, CNVD, CVE entries) confirm an information-disclosure path-traversal style exposure without wider exploitati...

CVE-2016-6846

Open-Xchange (OX) AppSuite across multiple components is affected by CVE-2016-6846: XSS allowing remote injection of arbitrary web script or HTML. Affected are the AppSuite backend (before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7.8.2-rev8), AppSuite frontend (before 7.6.2-rev47, 7.8....

CVE-2017-6846

The CVE-2017-6846 entry concerns PoDoFo 0.9.4: the GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace function may dereference a NULL pointer via a crafted file, leading to denial of service. The vulnerability is triggered by processing malicious PDFs and results in a crash/DOs withou...

CVE-2015-6846

EMC SourceOne Email Supervisor prior to version 7.2 contains hardcoded encryption keys, enabling an attacker to gain access by inspecting cryptographic operations in the program. This CVE (CVE-2015-6846) is documented in multiple feeds (NVD, CVE listings) with a common description of hardcoded ke...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6846, CVE-2014-6847. Reason: this ID was intended for one issue, but was assigned to two issues by a CNA. Notes: All CVE users should consult CVE-2014-6846 and CVE-2014-6847 to determine which ID is appropriate. All reference...

CVE-2014-6809

This CVE entry is rejected; it does not represent an active vulnerability.

CVE-2014-6846

CVE-2014-6846 concerns the Android app “The Four Seasons Beverly Hills” (com.intelitycorp.FourSeasons.android.ice, package @7F050007). The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling an attacker in a man‑in‑the‑middle position to spoof servers and o...

CVE-2008-6846

CVE-2008-6846 affects avast! AntiVirus for Linux, specifically Linux Home Edition versions 1.0.5, 1.0.5-1, and 1.0.8. The vulnerability consists of multiple stack-based buffer overflows in the handling of malformed ISO or RPM files, enabling remote attackers to trigger denial of service (applicat...

Fedora Core 9 FEDORA-2009-6846 (kernel)

The remote host is missing an update to kernel announced via advisory FEDORA-2009-6846. OpenVAS Vulnerability Test $Id: fcore20096846.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-6846 kernel Authors: Thomas Reinke Copyright: Copyright c 2009 E-So...

Fedora Core 9 FEDORA-2009-6846 (kernel)

The remote host is missing an update to kernel announced via advisory FEDORA-2009-6846. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

CVE-2006-6846

CVE-2006-6846 covers multiple SQL injection vulnerabilities in the While You Were Out (WYWO) InOut Board 1.0. The flaws allow remote attackers to run arbitrary SQL commands through: (1) num parameter in phonemessage.asp, (2) catcode parameter in faqDsp.asp, and (3) Username and (4) Password field...