4208 matches found
Easy Digital Downloads < 2.11.2.1 - Reflected Cross-Site Scripting
The plugin does not escape the start-date and end-date parameters in the payment history dashboard before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues PoC...
Easy Digital Downloads < 2.11.2.1 - Reflected Cross-Site Scripting
The plugin does not escape the start-date and end-date parameters in the payment history dashboard before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...
Google Chrome 输入验证错误漏洞
Chrome is a web browsing tool developed by Google, and an insufficient validation of untrusted input vulnerability exists in Downloads in versions prior to Google Chrome 95.0.4638.54. An attacker could exploit this vulnerability to bypass navigation restrictions via malicious files...
chromium -- multiple vulnerabilities
Chrome Releases reports: This release contains 19 security fixes, including: 1246631 High CVE-2021-37981: Heap buffer overflow in Skia. Reported by Yangkang @dnpushme of 360 ATA on 2021-09-04 1248661 High CVE-2021-37982: Use after free in Incognito. Reported by Weipeng Jiang @Krace from Codesafe...
PT-2021-8121 · Draytek · Draytek Vigorconnect
Name of the Vulnerable Software and Affected Versions: Draytek VigorConnect version 1.6.0-B3 Description: A local file inclusion vulnerability exists in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary...
CVE-2021-29760
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to download unauthorized files through the dashboard user interface. IBM X-Force ID: 202213...
IBM Sterling B2B Integrator 安全漏洞
IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with different partner communities. IBM Sterling B2B Integrator Standard Edition prior to...
OPENSUSE-SU-2021:1310-1 Security update for opera
This update for opera fixes the following issues: opera was updated to version 79.0.4143.22 - CHR-8550 Update chromium on desktop-stable-93-4143 to 93.0.4577.58 - CHR-8557 Update chromium on desktop-stable-93-4143 to 93.0.4577.63 - DNA-94641 Linux Proprietary media codecs not working in snap buil...
Security update for opera (important)
openSUSE Security Update: Security update for opera Announcement ID: openSUSE-SU-2021:1310-1 Rating: important References: Cross-References: CVE-2021-30606 CVE-2021-30607 CVE-2021-30608 CVE-2021-30609 CVE-2021-30610 CVE-2021-30611 CVE-2021-30612 CVE-2021-30613 CVE-2021-30614 CVE-2021-30615...
curl: Metalink download sends credentials
A flaw was found in curl in the way curl handles credentials when downloading content using the Metalink feature. This flaw allows malicious actors controlling a hosting server to gain access to credentials provided while downloading content without the user's knowledge. The highest threat from...
The vulnerability of the CiviCRM web-based contact tracking and interaction management system lies in the lack of restrictions on file downloads. This allows attackers to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of the CiviCRM contact tracking and interaction management web system is related to the ability to upload and execute PHAR archives. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, and cause service failure...
VulnCheck KEV: CVE-2020-24949
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...
Malicious Office documents make up 43% of all malware downloads
By Waqas In the 3rd quarter of 2020, around 38% of all downloadable malware were found hidden in Office documents, a new report reveals. This is a post from HackRead.com Read the original post: Malicious Office documents make up 43% of all malware downloads...
The vulnerability of the Pulse Connect Secure corporate network VPN server, related to the unlimited download of dangerous types of files, allows a hacker to execute arbitrary code.
The vulnerability of the Pulse Connect Secure corporate network VPN server is related to the unlimited download of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by downloading a specially created archive through the web administrator interface...
The vulnerability in the web application for managing email distributions, phplist, arises from the lack of restrictions on file downloads, allowing a perpetrator to execute arbitrary code.
The vulnerability of the phplist web application for managing email distributions is related to the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor to execute arbitrary code upon downloading the malicious plugin remotely...
The vulnerability of the prodViewUpdate.php implementation of the online e-commerce sales system allows a hacker to execute arbitrary code.
The vulnerability of the prodViewUpdate.php implementation in the online e-commerce website system is related to the unlimited downloading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
The vulnerability of Trend Micro Worry-Free Business Security and Apex One anti-virus software lies in the lack of restrictions on file downloads, which allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of Trend Micro Worry-Free Business Security and Apex One anti-virus software lies in the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information throug...
The vulnerability of the File Manager plugin (wp-file-manager) of the WordPress content management system allows a hacker to execute arbitrary PHP code on the target system.
The vulnerability of the File Manager plugin wp-file-manager in the WordPress content management system is related to the ability to download files of a dangerous type without limitation. Exploiting this vulnerability allows a malicious actor to execute any PHP code on the target system remotely...
The vulnerability in the Google Chrome web browser, related to insufficient validation of data entered by users, allows attackers to carry out spear-phishing attacks.
The vulnerability in the Google Chrome web browser is related to insufficient validation of the data entered by users in the “Downloads” folder. Exploiting this vulnerability allows a malicious actor to carry out spear-phishing attacks using a specially created malicious web page...