CVE-2023-33405

CVE-2023-33405 Vulnerabilidad de redirección abierta identificada en BlogEngine.NET CMS versión 3.3.8.0 y anteriores Si una solicitud GET a la página default.aspx contiene "years=" dentro de la URL, la aplicación llama a una función llamada "Redirect". Esta función establece varios parámetros,...

CVE-2023-33404

CVE-2023-33404 拥有 BlogEngine.NET CMS（版本 3.3.8.0 及更早版本）EditOwnPosts 权限的用户，能够将恶意文件上传到硬编码位置。 向 /api/upload 端点发送包含 action=video 参数的 POST 请求（如下截图所示）会触发文件上传过程。 首先，应用程序会检查用户是否拥有 EditOwnPosts 权限以继续视频上传，否则会报错。 如下截图所示，在第 101 和 105 行，应用程序为上传的文件设置了硬编码位置。之后，它调用名为 UploadVideo 的函数（第 107 行）。 UploadVideo...

CVE-2018-14485

BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd...

EUVD-2019-2514

Malware in sbrugna...

EUVD-2019-3070

Malware in sbrugna...

EUVD-2019-2515

Malware in sbrugna...

EUVD-2019-2513

Malware in sbrugna...

EUVD-2013-6754

Malware in sbrugna...

EUVD-2019-2512

Malware in sbrugna...

EUVD-2008-6446

Malware in sbrugna...

EUVD-2022-30252

Malicious code in bioql PyPI...

EUVD-2023-26966

Malicious code in bioql PyPI...

EUVD-2022-44611

Malicious code in bioql PyPI...

EUVD-2022-33356

Malicious code in bioql PyPI...

EUVD-2023-26967

Malicious code in bioql PyPI...

EUVD-2023-26968

Malicious code in bioql PyPI...

EUVD-2022-44610

Malicious code in bioql PyPI...

CVE-2023-33405

Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect...

CVE-2023-33404

An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code...

CVE-2022-41417

BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under /AppData/...