1793 matches found
CVE-2022-23050: Uncontrolled Search Path Element
ManageEngine AppManager15 Build No:15510 allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries' functionality...
PT-2022-15810 · Zoho · Manageengine Appmanager15
Name of the Vulnerable Software and Affected Versions: ManageEngine AppManager15 version 15510 Description: The issue allows an authenticated admin user to upload a DLL file, enabling a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries' functionality...
CVE-2022-29447
Authenticated administrator or higher user role Local File Inclusion LFI vulnerability in Wow-Company's Hover Effects plugin = 2.1 at WordPress...
CVE-2022-29432
Multiple Authenticated administrator or higher user role Persistent Cross-Site Scripting XSS vulnerabilities in TMS-Plugins wpDataTables plugin = 2.1.27 on WordPress via &data-link-text, &data-link-url, &data, &data-shortcode, &data-star-num vulnerable parameters...
GHSA-W47P-5Q88-HJ5G Path Traversal in Apache Jetspeed
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. dot dot in a ZIP archive entry, as demonstrated by...
CVE-2022-29448
Authenticated admin or higher user role Local File Inclusion LFI vulnerability in Wow-Company's Herd Effects plugin = 5.2 at WordPress...
CVE-2022-0024
A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committ...
CVE-2021-36844
Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in MyThemeShop WP Subscribe plugin = 1.2.12 on WordPress...
CVE-2022-29422
Multiple Authenticated admin+ Persistent Cross-Site Scripting XSS vulnerabilities in Adam Skaat's Countdown & Clock plugin = 2.3.2 at WordPress via &ycd-countdown-width;, &ycd-progress-height;, &ycd-progress-width;, &ycd-button-margin-top;, &ycd-button-margin-right;, &ycd-button-margin-bottom;,...
CVE-2022-29418
Authenticated admin user role Persistent Cross-Site Scripting XSS in Mark Daniels Night Mode plugin = 1.0.0 on WordPress via vulnerable parameters: &ntmodepagesettingenable-me, &ntmodepagesettingbg-color, &ntmodepagesettingtxt-color, &ntmodepagesettinganccolor...
CVE-2022-28743
Time-of-check Time-of-use TOCTOU Race Condition vulerability in Foscam R2C IP camera running System FW = 1.13.1.6, and Application FW = 2.91.2.66, allows an authenticated remote attacker with administrator permissions to execute arbitrary remote code via a malicious firmware patch. The impact of...
CVE-2022-27848
Authenticated admin+ user Stored Cross-Site Scripting XSS in Modern Events Calendar Lite WordPress plugin = 6.5.1...
CVE-2021-36846
Authenticated admin or higher user role Stored Cross-Site Scripting XSS vulnerability in Premio Chaty WordPress plugin = 2.8.3...
CVE-2022-27845
Authenticated admin or higher user role Stored Cross-Site Scripting XSS in PlausibleHQ Plausible Analytics WordPress plugin = 1.2.2...
CVE-2022-25618
Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in wpDataTables WordPress plugin versions = 2.1.27...
CVE-2022-25618
Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in wpDataTables WordPress plugin versions = 2.1.27...
CVE-2021-33523
MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new JDBC driver that can execute arbitrary commands on the underlying host. This occurs in com.idsscheer.ppmmashup.business.jdbc.DriverUploadController...
CVE-2021-33523
MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new JDBC driver that can execute arbitrary commands on the underlying host. This occurs in com.idsscheer.ppmmashup.business.jdbc.DriverUploadController...
