9348 matches found
CVE-2021-27221
MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position is that this is intended behavior because of how user policies work...
PT-2021-3982 · WordPress · Woocommerce Stock Manager
Name of the Vulnerable Software and Affected Versions: WooCommerce Stock Manager versions up to, and including, 2.5.7 Description: The issue is related to the implementation of the import/export functionality in the WooCommerce Stock Manager plugin for WordPress, specifically in the...
CVE-2021-24146
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example...
CVE-2021-24146
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example...
Format string
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example...
CVE-2021-24132
The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulkaction, exportfull and savesliderdb functionalities of the plugin were vulnerable, allowing a high privileged user Admin, or medium one such as Contributor+ if "Role Options" is turn on for other users to perform a SQL...
CVE-2021-24146
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example...
CVE-2021-24146 Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example...
CVE-2021-24146
CVE-2021-24146 affects WordPress Modern Events Calendar Lite (versions before 5.16.5). The flaw is lack of proper authorization checks that do not restrict access to exported event files, allowing unauthenticated users to retrieve all events data in CSV or XML formats. Affected plugin: Modern Eve...
PT-2021-2491 · Mikrotik · Mikrotik Routeros
Name of the Vulnerable Software and Affected Versions: MikroTik RouterOS version 6.47.9 Description: The issue allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. It is noted that the vendor considers this behavior as intended due to how user...
PT-2021-15692 · WordPress · Modern Events Calendar Lite
Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite WordPress plugin versions prior to 5.16.5 Description: The issue is related to a lack of authorization checks in the plugin, which did not properly restrict access to export files. This allowed unauthenticated user...
MikroTik RouterOS 命令注入漏洞
MikroTik RouterOS is a Linux-based router operating system developed by the Latvian company MikroTik. The system can be deployed in a PC to enable it to provide router functionality. A security vulnerability exists in MikroTik RouterOS version 6.47.9 that allows remote authenticated ftp users to...
Logic Flaw Vulnerability in Yitoa Graphics
Yitoa Chart is a comprehensive graphic chart design software. A logic flaw vulnerability exists in Yitoa Diagrams. An attacker can exploit the vulnerability to bypass logical validation and export an unwatermarked graphic...
USN-4878-1 linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities
It was discovered that the Marvell WiFi-Ex device driver in the Linux kernel did not properly validate ad-hoc SSIDs. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2020-36158 Ryota Shiga discovered that the sockopt BPF hooks in th...
USN-4877-1 linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that the Marvell WiFi-Ex device driver in the Linux kernel did not properly validate ad-hoc SSIDs. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2020-36158 吴异 discovered that the NFS implementation in the Linux...
USN-4876-1 linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
Olivier Benjamin and Pawel Wieczorkiewicz discovered a race condition the Xen paravirt block backend in the Linux kernel, leading to a use-after-free vulnerability. An attacker in a guest VM could use this to cause a denial of service in the host OS. CVE-2020-29569 It was discovered that the...
Information Disclosure
highcharts-export-server is vulnerable to information disclosure. If the export server is accessible via internet, it allows reading of internal HTTP resources and outputting files served by other services on the internal network in which the export server is hosted...
The name of a filter can be used to XSS users who open an "Export HTML Report" - CVE-2021-26083
Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in Export HTML Report feature. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before...
SonicWall SMA100 Authorization Issues Vulnerability
The SonicWall SMA100 is a secure access gateway appliance from SonicWALL USA. An authorization issue vulnerability exists in SonicWall SMA100 version 10.2.0.5 and prior versions, which can be exploited by an attacker to export a target profile to a specified email address...
