14663 matches found
Media from FTP < 11.17 - Author+ Arbitrary File Access
Description The plugin does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases. In 11.16, the manageoptions capability was used, however is still insufficient in case of MultiSite...
The vulnerability of the ANGLE library in Google Chrome browsers allows a hacker to read and write arbitrary files in the system.
The vulnerability of the ANGLE library in the Google Chrome browser is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to read and write arbitrary files on the system using a specially crafted HTML page...
Media from FTP < 11.17 - Author+ Arbitrary File Access
Description The plugin does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases. In 11.16, the manageoptions capability was used, however is still insufficient in case of MultiSite...
Orders Tracking for WooCommerce < 1.2.6 - Admin+ Arbitrary File Access/Read
Description The plugin doesn't validate the fileurl parameter when importing a CSV file, allowing high privilege users with the managewoocommerce capability to access any file on the web server via a Traversal attack. The content retrieved is however limited to the first line of the file. PoC As ...
HPESBNW04527 rev.2 - Multiple Vulnerabilities in HPE Aruba Networking Virtual Intranet Access (VIA) Windows Client
Potential Security Impact: Local: Creation and Deletion of Arbitrary Files, Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba Virtual Intranet Access VIA Windows Client Only - All versions 4.5 and lower CVSS Scores: | CVE | CVSS Vector | Base Score | |...
Orders Tracking for WooCommerce < 1.2.6 - Admin+ Arbitrary File Access/Read
Description The plugin doesn't validate the fileurl parameter when importing a CSV file, allowing high privilege users with the managewoocommerce capability to access any file on the web server via a Traversal attack. The content retrieved is however limited to the first line of the file. As an...
CVE-2023-39403
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization...
CVE-2023-39399
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization...
CVE-2023-39400
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization...
Authorization
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization...
CVE-2023-39402
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization...
CVE-2023-39400
CVE-2023-39400 is a parameter verification vulnerability in the installd module. Multiple connected sources describe it as allowing unauthorized access to sandbox files by reading and writing them, with the issue being exploitable remotely (network) and requiring no user interaction; the impact i...
Google Chrome Security Bypass Vulnerability (CNVD-2023-63444)
Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome versions prior to 108.0.5359.71 due to an improper implementation in DevTools. An attacker can use this vulnerability to bypass file access restrictions to install malicious...
PT-2023-4419
Name of the Vulnerable Software and Affected Versions Apache Airflow Drill Provider versions prior to 2.4.3 Description The issue is related to improper input validation in Apache Airflow Drill Provider, allowing an attacker to pass malicious parameters when establishing a connection with...
i2soft CMS 2.0 Insecure Direct Object Reference
==================================================================================================================================== | Title : i2soft CMS v2.0 Insecure Direct Object Reference Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefo...
The vulnerability of the DevTools set of tools for web development in the Google Chrome browser allows a hacker to gain access to and modify files.
The vulnerability of the DevTools set of tools for web development in the Google Chrome browser is related to an incorrect path limitation for accessing restricted directories. Exploiting this vulnerability could allow a malicious actor to remotely access and modify files by downloading a special...
CVE-2023-30701
PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access...
CVE-2023-30701
PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access...
