CVE-2023-41374

Double free issue exists in Kostac PLC Programming Software Version 1.6.11.0 and earlier. Arbitrary code may be executed by having a user open a specially crafted project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier because the issue exists in parsing of...

CVE-2023-41374

Double free issue exists in Kostac PLC Programming Software Version 1.6.11.0 and earlier. Arbitrary code may be executed by having a user open a specially crafted project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier because the issue exists in parsing of...

PT-2023-5518 · Kostac · Kostac Plc Programming

Name of the Vulnerable Software and Affected Versions: Kostac PLC Programming Software versions 1.6.9.0 and earlier Kostac PLC Programming Software version 1.6.11.0 Description: The issue is related to a use after free vulnerability, which can be exploited by opening a specially crafted project...

Path Traversal

pimcore/pimcore is vulnerable to Path Traversal. A path traversal flaw exists in AssetController::importServerFilesAction, which allows an attacker to alter the pimcorelog argument, possibly overwriting or modifying sensitive files. This might also lead to illegal access, privilege escalation, or...

CVE-2023-32608

Directory traversal vulnerability in Pleasanter Community Edition and Enterprise Edition 1.3.39.2 and earlier versions allows a remote authenticated attacker to alter an arbitrary file on the server...

Directory traversal

Directory traversal vulnerability in Pleasanter Community Edition and Enterprise Edition 1.3.39.2 and earlier versions allows a remote authenticated attacker to alter an arbitrary file on the server...

CVE-2023-32608

Directory traversal vulnerability in Pleasanter Community Edition and Enterprise Edition 1.3.39.2 and earlier versions allows a remote authenticated attacker to alter an arbitrary file on the server...

CVE-2023-32608

Directory traversal vulnerability in Pleasanter Community Edition and Enterprise Edition 1.3.39.2 and earlier versions allows a remote authenticated attacker to alter an arbitrary file on the server...

PT-2023-23908 · Unknown · Pleasanter

Name of the Vulnerable Software and Affected Versions: Pleasanter versions 1.3.39.2 and earlier Description: A directory traversal issue allows a remote authenticated attacker to alter an arbitrary file on the server. Recommendations: For versions 1.3.39.2 and earlier, update to a version later...

JVN#97818024: Multiple vulnerabilities in Pleasanter

Pleasanter provided by Implem Inc. contains multiple vulnerabilities listed below. Stored cross-site scripting vulnerability CWE-79 - CVE-2023-32607 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N| Base Score: 5.4 CVSS v2| AV:N/AC:M/Au:S/C:N/I:P/A:N| Base...

CVE-2022-46660

GE Digital Proficy Historian CVE-2022-46660 is a path/unsafe file write vulnerability affecting Proficy Historian (v7.0 and up per ICS advisory context). Connected sources describe exploitation via unrestricted upload of files and MSO protocol handling that allows an unauthorized user to alter or...

CVE-2022-42458

Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticated attacker to upload an arbitrary file. As a result, an arbitrary script may be executed and/or a file may be altered...

CVE-2022-30602

Operation restriction bypass in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to alter the file information and/or delete the files...

Design/Logic Flaw

Operation restriction bypass in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to alter the file information and/or delete the files...

CVE-2022-30602

Operation restriction bypass in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to alter the file information and/or delete the files...

CVE-2022-30602

The CVE-2022-30602 issue affects Cybozu Garoon 4.0.0–5.9.1. Description and connected sources confirm an authorization/privilege-management flaw (operation restriction bypass) that lets an authenticated remote user alter file information and/or delete files. The root cause is an improper privileg...

Code injection

Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup. This leads of leaking the database credentials in the environment variables...

CVE-2021-39458

The CVE-2021-39458 issue affects Yakamara Media Redaxo CMS 5.12.1, where an authenticated CMS user can trigger an error in the import process to swap files from a valid backup. This leads to leakage of database credentials stored in environment variables. The available connected documents confirm...

CVE-2021-22125

An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow an authenticated administrator to execute commands on the underlying system's shell via altering the content of its configuration file...

wpCentral < 1.4.8 - Privilege Escalation

There’s a vulnerability that allows anyone who is logged in with any user role to escalate their privilege, or alter/upload any file, or adjust any plugin and interact with the site in many other ways. PoC In wpcentral.php, AJAX actions are registered. However, it's only checking whether or not t...