141 matches found
PT-2022-22957 · WordPress · Wpforms Pro
Name of the Vulnerable Software and Affected Versions: WPForms Pro version 1.7.6 and earlier Description: The issue arises from the lack of validation of form data when generating exported CSV files, potentially leading to CSV injection. Recommendations: For WPForms Pro versions prior to 1.7.7,...
PT-2022-21932 · Unknown · Wp All Export Pro
Name of the Vulnerable Software and Affected Versions: WP All Export Pro versions prior to 1.7.9 Description: The issue allows users with permission to run exports to execute arbitrary SQL statements due to the direct use of the cc sql POST parameter as a database query. This affects users who ha...
Information Disclosure
gitit is vulnerable to information disclosure. The vulnerability exists through the export feature, allowing an attacker to gain sensitive information via files...
CVE-2022-29315
Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used...
CVE-2021-36202
Server-Side Request Forgery SSRF vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0....
CVE-2021-24780
The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able...
Cross site request forgery (csrf)
The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able...
CVE-2021-24780 Single Post Exporter <= 1.1.1 - Plugin's Settings Update via CSRF
The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able...
CVE-2021-24780
The CVE-2021-24780 entries describe a CSRF vulnerability in the WordPress plugin “Single Post Exporter” versions up to 1.1.1, where saving settings lacks CSRF checks. Root cause: missing CSRF validation in the settings update function, which can let an authenticated attacker change settings and g...
CVE-2021-24780: Cross-Site Request Forgery (CSRF)
The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able...
PT-2021-16275
Name of the Vulnerable Software and Affected Versions: The Single Post Exporter WordPress plugin versions 1.1.1 and earlier Description: The issue concerns a lack of CSRF checks when saving settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This could...
Single Post Exporter <= 1.1.1 - Plugin's Settings Update via CSRF
The plugin does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able to export an arbitrary post/page such as...
CVE-2021-22258: Undefined Security Weakness
The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...
GitLab 访问控制错误漏洞
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to view the contents of a project's files, commit history, bug lists, and more. GitLab suffers from an Access Control Error...
GHSA-54GP-QFF8-946C Insecure direct object reference of log files of the Import/Export feature
Impact Insecure direct object reference of log files of the Import/Export feature Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6...
Design/Logic Flaw
Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object reference of log files of the Import/Export feature. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding securit...
CVE-2021-37709 Insecure direct object reference of log files of the Import/Export feature
Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object reference of log files of the Import/Export feature. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding securit...
CVE-2021-38711
In gitit before 0.15.0.0, the Export feature can be exploited to leak information from files...