138 matches found
Projectsend 安全漏洞
An information disclosure vulnerability exists in ProjectSend version r1295, a free, customer-facing private file sharing web application. The vulnerability stems from the ids parameter in files-edit.php and the id parameter in process.php not checking for authorization. An attacker could exploit...
CVE-2020-22392: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file...
CVE-2021-27367
Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal...
Bolt CMS 路径遍历漏洞
Bolt is a simple CMS written in PHP. A directory traversal vulnerability exists in Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in versions of Bolt prior to 4.1.13. No detailed vulnerability details are provided at this time...
CVE-2020-28187
Multiple directory traversal vulnerabilities in TerraMaster TOS = 4.2.06 allow remote authenticated attackers to read, edit or delete any file within the filesystem via the 1 filename parameter to /tos/index.php?editor/fileGet, Event parameter to /include/ajax/logtable.php, or opt parameter to...
Security update for fossil (important)
openSUSE Security Update: Security update for fossil Announcement ID: openSUSE-SU-2020:1478-1 Rating: important References: 1047218 1175760 Cross-References: CVE-2020-24614 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 An upda...
PT-2020-14253
Name of the Vulnerable Software and Affected Versions SOY Inquiry versions 2.0.0.3 and earlier Description The issue affects the SOY Inquiry component of SOY CMS, allowing remote attackers to force administrators to edit files by loading a specially crafted webpage. This can happen when an...
CVE-2020-25287
Pligg 2.0.3 allows remote authenticated users to execute arbitrary commands because the template editor can edit any file, as demonstrated by an admin/admineditor.php thefile=..%2Findex.php&open=Open request...
PT-2019-12243
Name of the Vulnerable Software and Affected Versions Singularity versions 3.1.0 through 3.2.0-rc2 Description An issue allows a malicious user with local or network access to the host system to exploit insecure permissions. This enables the user to edit files within...
PT-2019-12067
Name of the Vulnerable Software and Affected Versions Bolt CMS version 3.6.6 Description The issue allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file through the bolt/upload File...
CVE-2018-16207: Undefined Security Weakness
PowerAct Pro Master Agent for Windows Version 5.13 and earlier allows authenticated attackers to bypass access restriction to alter or edit unauthorized files via unspecified vectors...
CVE-2018-20597
UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...
CVE-2018-20599
UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadminfileedit action...
“For security reasons DTD is prohibited in this XML document” error in Veeam Backup for Microsoft 365
Challenge Interactions with either SharePoint Online or OneDrive for Business within Veeam Backup for Microsoft 365 fail with either of the following errors: For security reasons DTD is prohibited in this XML document Copy Identity Client Runtime Library IDCRL could not look up the realm...
CVE-2018-16145
The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 invokes a file that can be edited by the nagios user, and would allow attackers to elevate their privileges to root after a system restart, hence obtaining full control of...
DEBIAN-CVE-2017-18226
The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script executes a "kill -TERM cat...
zzcms v1.5.3.0129 version exists arbitrary file editing vulnerability
ZZCMS is an enterprise website builder. zzzcms v1.5.3.0129 version of the existence of arbitrary file editing vulnerability. The vulnerability stems from the fact that the file name, file path and file content of the file to be modified are not filtered, leading to a vulnerability that can be...
Arbitrary File Editing Vulnerability in bagecms v3.1.3 Version
BageCms is a multi-functional open source web content management system based on php5+mysql5 development. bagecms v3.1.3 version of the existence of arbitrary file editing vulnerability, the vulnerability stems from the file path to modify the file and to write the contents of the file are not...
