Leostream Connection Broker 代码问题漏洞

Leostream Connection Broker is a vendor-neutral connection broker from Leostream USA that provides a single interface to manage a range of operating systems, physical and virtual desktops, and display protocols commonly found in enterprise environments. A security vulnerability exists in Leostrea...

Croogo 3.0.2 Remote Code Execution

Exploit Title: Croogo 3.0.2 - Remote Code Execution Authenticated Date: 05/12/2021 Exploit Author: Deha Berkin Bir Vendor Homepage: https://croogo.org/ Software Link: https://downloads.croogo.org/v3.0.2.zip Version: 3.0.2 Tested on: Windows 10 Home Single Language 20H2 & WampServer 3.2.3 ==...

Multiple vulnerabilities in baserCMS

Overview baserCMS provided by baserCMS Users Community contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2021-41243 Arbitrary code upload vulnerability in Database restore CWE-434 - CVE-2021-41279 CVE-2021-41243 Akagi Yusuke of NTT-ME CORPORATION reported this...

JVN#81376414: Multiple vulnerabilities in baserCMS

baserCMS provided by baserCMS Users Community contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2021-41243 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| Base Score: 8.8 CVSS v2| AV:N/AC:L/Au:S/C:C/I:C/A:C| Base Score: 9.0...

SourceCodester Phone Shop Sales Management System 代码问题漏洞

SourceCodester Phone Shop Sales Management System is a PHP project called Phone Shop Sales Management System by SourceCodester USA. The project manages phone store sales transactions. A file upload vulnerability exists in SourceCodester Phone Shop Sales Management System, which can be exploited b...

PT-2021-10625

Name of the Vulnerable Software and Affected Versions: uniview ISC2500-S affected versions not specified Description: An issue was discovered where an attacker can upload malicious code via the "Interface/DevManage/EC.php?cmd=upload" endpoint. Recommendations: At the moment, there is no informati...

CVE-2021-27817

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix...

CVE-2020-25790

Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered trustworthy"; however, the behavior "contradicts our security policy" and is being...

PT-2020-6318

Name of the Vulnerable Software and Affected Versions wp-file-manager plugin versions prior to 6.9 Description The issue allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This allows attackers ...

Malicious Package in mysql-koa

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise...

phpCollab Arbitrary File Upload Vulnerability

phpCollab is a set of Web-based project collaboration management software. The software features task assignments, discussions, logs and notifications. An arbitrary file upload vulnerability exists in phpCollab. An attacker can exploit the vulnerability to upload malicious php files...

CVE-2020-10806

eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php...

PT-2020-12336

Name of the Vulnerable Software and Affected Versions eZ Publish Kernel versions 5.4.14.1 and earlier, 6.x versions prior to 6.13.6.2, 7.x versions prior to 7.5.6.2 eZ Publish Legacy versions 5.4.14.1 and earlier, 2017 versions prior to 2017.12.7.2, 2019 versions prior to 2019.03.4.2 Description...

CVE-2019-7589: Improper Input Validation

A vulnerability with the SmartService API Service option exists whereby an unauthorized user could potentially exploit this to upload malicious code to the server that could be executed at system level privileges. This affects Johnson Controls' Kantech EntraPass Corporate Edition versions 8.0 and...

Guangzhou Qibo Network Technology Co., Ltd. Qibo cms has XSS vulnerability

Qibo CMS system is an open source CMS system that provides a variety of modules including articles, images, downloads, shopping malls, built-in features, orders, exams and more. Guangzhou Qibo Network Technology Co., Ltd. Qibo CMS XSS vulnerability, attackers can use the vulnerability in the...

CVE-2020-3138: Improper Verification of Cryptographic Signature

A vulnerability in the upgrade component of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to install a malicious file when upgrading. The vulnerability is due to insufficient signature validation. An attacker could exploit this vulnerability by...

PT-2019-4193 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions 8.1.1 through 8.2.0 Description: The issue is related to an insecure setting in the default solr.in.sh configuration file, which enables JMX monitoring without authentication on the RMI PORT default port 18983. This could...

CVE-2019-17188

An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restriction and upload PHP code to the webserver, by providing image data and the image/jpeg content type, with a .php extension. This occurs...

PT-2019-14992

Name of the Vulnerable Software and Affected Versions Fecshop FecMall version 2.3.4 Description An issue was found where an attacker can bypass front-end restrictions and upload PHP code to the webserver. This is done by providing image data with a .php extension and the image/jpeg content type...

Malicious Package

Overview This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise. References GitHub Advisory...