MCL-Net 安全漏洞

MCL-Net is a network appliance from MCL Corporation. A security vulnerability exists in MCL-Net 4.3.5.8788 that originates from allowing an attacker to obtain sensitive information about a configured database via the /file endpoint...

CVE-2023-34747

File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload...

CVE-2022-45170

An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/file endpoint. A malicious user, logged into a victim's account, is able to decipher a file without knowing the key set by the user...

PT-2023-14626 · Unknown · Livebox Collaboration Vdesk

Name of the Vulnerable Software and Affected Versions: LIVEBOX Collaboration vDesk versions through v018 Description: A cryptographic issue can occur under the "/api/v1/vencrypt/decrypt/file" endpoint, allowing a malicious user, logged into a victim's account, to decipher a file without knowing t...

Atlassian Bitbucket < 5.16.11 Multiple Vulnerabilities

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is prior to 5.16.11, 6.0.x prior to 6.0.11, 6.1.x prior to 6.1.9, 6.2.x prior to 6.2.7, 6.3.x prior to 6.3.6, 6.4.x prior to 6.4.4, 6.5.x prior to 6.5.3, 6.6.x prior to 6.6.3, 6.7.x prior...

PT-2023-20440 · Unknown +2 · Zoneminder +2

Name of the Vulnerable Software and Affected Versions: ZoneMinder versions prior to 1.36.33 ZoneMinder versions prior to 1.37.33 Description: The issue concerns a Local File Inclusion vulnerability via the "web/ajax/modal.php" endpoint, where an arbitrary php file path can be passed in the reques...

PT-2022-27165 · Unknown · Automotive Shop Management System

Name of the Vulnerable Software and Affected Versions: Automotive Shop Management System version 1.0 Description: The issue allows deletion of any file via the "/asms/classes/Master.php?f=delete img" API endpoint. Recommendations: For Automotive Shop Management System version 1.0, as a temporary...

PT-2022-27114 · Dedecmdv6 · Dedecmdv6

Name of the Vulnerable Software and Affected Versions: dedecmdv6 version 6.1.9 Description: The issue allows for Remote Code Execution RCE via the file manage control.php endpoint. Recommendations: For dedecmdv6 version 6.1.9, consider restricting access to the file manage control.php endpoint...

CVE-2022-35426

UCMS 1.6 is vulnerable to arbitrary file upload via ucms/sadmin/file PHP file...

CVE-2022-31966

ChatBot App with Suggestion v1.0 is vulnerable to Delete any file via /simplechatbot/classes/Master.php?f=deleteimg...

Room-rent-portal-site SQL注入漏洞

Room-rent-portal-site is a room for rent portal by the individual developer Carlo Montero. A security vulnerability exists in Room-rent-portal-site v1.0, which stems from an SQL injection issue in /rrps/classes/Master.php?f=deletecategory...

CVE-2021-43484

A Remote Code Execution RCE vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the extension of the file being sent in a request...

meshery SQL注入漏洞

meshery is a software application. A multi-service grid management plane that provides lifecycle, configuration and performance management of service grids and their workloads. Layer5 Meshery 0.5.2 suffers from a SQL injection vulnerability that can be exploited by an attacker to execute arbitrar...

PT-2021-14682 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.286 and earlier Jenkins LTS versions 2.277.1 and earlier Description: The issue arises from the lack of validation of the type of object created after loading data submitted to the "config.xml" REST API endpoint of a node...

PT-2020-17026

Name of the Vulnerable Software and Affected Versions orbisius-child-theme-creator plugin versions prior to 1.5.2 Description The issue allows for CSRF via the orbisius ctc theme editor manage file endpoint. Recommendations For versions prior to 1.5.2, update to version 1.5.2 or later to resolve...

CVE-2019-15012

Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0...

Remote code execution

Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0...

CVE-2018-15486

An issue was discovered on KONE Group Controller KGC devices before 4.6.5. Unauthenticated Local File Inclusion and File modification is possible through the open HTTP interface by modifying the name parameter of the file endpoint, aka KONE-02...

PT-2017-11790

Name of the Vulnerable Software and Affected Versions dataTaker DT80 dEX version 1.50.012 Description The issue allows remote attackers to obtain sensitive credential and configuration information. This can be achieved via a direct request for the "/services/getFile.cmd?userfile=config.xml" API...

Arbitrary File Upload Vulnerability in SignName Parameter of Tibco Call Center System

The core of Tibco's call center system is a communication-based system for internal and external corporate communication. An arbitrary file upload vulnerability exists in the signName parameter of the Tibus Communication Call Center System. 1 File upload: /sysmaint/import/import.php, save...