CVE-2022-1574

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files such as PHP on the remote server...

CVE-2022-29237 Limited Authentication Bypass for Media Files in Opencast

Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users could pass along URLs for files belonging to organizations other than the user's own, which Opencast would then import into the current organization, bypassin...

CVE-2021-25010

CVE-2021-25010 affects the WordPress Post Snippets plugin prior to 3.1.4. The root cause is absence of CSRF checks when importing files, allowing a logged-in admin to import arbitrary snippets. Imported snippets are not sanitized/escaped, enabling Stored Cross-Site Scripting (XSS). Documented ref...

CVE-2021-25010: Cross-Site Request Forgery (CSRF)

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues...

PT-2022-9567

Name of the Vulnerable Software and Affected Versions Post Snippets WordPress plugin versions prior to 3.1.4 Description The issue allows an attacker to make a logged-in admin import arbitrary snippets due to the lack of a CSRF check when importing files. Additionally, the imported snippets are n...

Directory Traversal

pimcore is vulnerable to directory traversal. It does not properly handle session for file import, exposing server path for translation import...

Post Snippets < 3.1.4 - CSRF to Stored Cross-Site Scripting

The plugin does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues PoC The XSS will be triggered anywhere in the backe...

CVE-2021-43802

Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an .etherpad file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad plugin that can execute...

Etherpad 安全漏洞

Etherpad is open source a Web-based online document collaboration tool . Multiple users can simultaneously write a text document through Etherpad , and see all the participants of real-time editing . A security vulnerability exists in Etherpad versions prior to 1.8.16. The vulnerability stems fro...

WordPress插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. The WordPress plugin suffers from a cross-sit...

PT-2021-6951

Name of the Vulnerable Software and Affected Versions mySCADA myDESIGNER versions 8.20.0 and prior Description The issue is related to errors in processing relative paths to directories when importing a project file. This may allow an attacker to plant files on the file system in arbitrary...

PT-2021-9136

Name of the Vulnerable Software and Affected Versions SIMATIC RTLS Locating Manager versions prior to V2.12 Description A issue has been identified where the application does not properly handle the import of large configuration files. This could allow a local attacker to import a specially craft...

PT-2021-3895

Name of the Vulnerable Software and Affected Versions MOXA WAC-2004 version 1.7 MOXA WAC-1001 version 2.1 MOXA WAC-1001-T version 2.1 MOXA OnCell G3470A-LTE-EU version 1.7 MOXA OnCell G3470A-LTE-EU-T version 1.7 MOXA TAP-323-EU-CT-T version 1.3 MOXA TAP-323-US-CT-T version 1.3 MOXA TAP-323-JP-CT-...

The vulnerability of microprogrammed software in industrial modems of the OnCell G3470A-LTE Series and WDR-3124A Series, as well as in microprogrammed software for Wi-Fi routers of the TAP-323 Series, WAC-1001 Series, and WAC-2004 Series, arises from the lack of protective measures for website structures. This allows attackers to import any file through the web interface.

The vulnerabilities of microprogrammed software in industrial modems of the OnCell G3470A-LTE Series, WDR-3124A Series, microprogrammed software in Wi-Fi routers of the TAP-323 Series, WAC-1001 Series, and WAC-2004 Series are related to the lack of measures taken to protect the website structure...

CVE-2021-22722: Improper Neutralization of Input During Web Page Generation

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Stored Cross-site Scripting' vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all...

PT-2021-7770

Name of the Vulnerable Software and Affected Versions EVlink City versions prior to R8 V3.4.0.1 EVlink Parking versions prior to R8 V3.4.0.1 EVlink Smart Wallbox versions prior to R8 V3.4.0.1 Description A CWE-79: Improper Neutralization of Input During Web Page Generation 'Stored Cross-site...

CVE-2021-22754

A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition Def.exe V15.0.0.21140 and prior that could result in loss of data or remote code execution due to lack of proper validation of user-supplied data, when a malicious CGF file is imported to IGSS Definition...

CVE-2021-22760

A CWE-763: Release of invalid pointer or reference vulnerability exists inIGSS Definition Def.exe V15.0.0.21140 and prior that could result in loss of data or remote code execution due to missing checks of user-supplied input data, when a malicious CGF file is imported to IGSS Definition...

CVE-2021-22759

A CWE-416: Use after free vulnerability exists inIGSS Definition Def.exe V15.0.0.21140 and prior that could result in loss of data or remote code execution due to use of unchecked input data, when a malicious CGF file is imported to IGSS Definition...

CVE-2021-22750

A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition Def.exe V15.0.0.21041 and prior that could result in loss of data or remote code execution due to missing length checks, when a malicious CGF file is imported to IGSS Definition...