2062 matches found
CVE-2022-2634
An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...
Fileserver Application Apache ActiveMQ Download Execution
The vulnerability of the Fileserver application of the Apache ActiveMQ software platform exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to upload and execute any file using the HTTP PUT method, followed by an HTTP MOVE request...
SUSE SLES15 Security Update : rubygem-tzinfo (SUSE-SU-2022:2592-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:2592-1 advisory. - TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to...
Design/Logic Flaw
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.0 49183. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...
PT-2022-16250
Name of the Vulnerable Software and Affected Versions NeoRS affected versions not specified Description The issue is related to an origin validation error vulnerability in NeoRS's ActiveX module, which allows attackers to download and execute arbitrary files. Remote attackers can exploit this to...
CVE-2022-23763: Origin Validation Error
Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers can use this vulerability to encourage users to access crafted web pages, causing damage such as malicious code infections...
Vulnerability fixed in RealVNC VNC Server
RealVNC has fixed a vulnerability in VNC Server for Windows. A local, authenticated malicious party can exploit the exploit the vulnerability to obtain elevated privileges on the system on which VNC Server is installed. The vulnerability is caused by an installation file executing files in %TEMP%...
PT-2022-19621
Name of the Vulnerable Software and Affected Versions Hover Effects plugin versions = 2.1 Description The issue is related to an Authenticated Local File Inclusion LFI vulnerability. This means that an attacker with administrator or higher user role privileges can potentially include and execute...
Input validation
Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable function...
PT-2022-9779
Name of the Vulnerable Software and Affected Versions HANDY Groupware affected versions not specified Description The issue is related to an improper input validation vulnerability in HANDY Groupware's ActiveX module. This allows attackers to download or execute arbitrary files by exploiting the...
Handysoft Groupware 输入验证错误漏洞
Handysoft Handy Groupware is an office collaboration solution from Handysoft Korea. The product supports features such as meeting management, attendance management, and human resource assessment. A security vulnerability exists in Handysoft Groupware for Windows, which originates from incorrect...
CVE-2021-26630: Improper Input Validation
Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable function...
PT-2022-19619
Name of the Vulnerable Software and Affected Versions Wow-Company's Popup Box plugin versions = 2.1.2 Description The issue is related to an Authenticated Local File Inclusion LFI vulnerability. This means that an attacker with administrator or higher role privileges can potentially include and...
GHSA-CGRV-6H2H-6F7V MODX Revolution Directory Traversal Vulnerability
In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...
PT-2022-9774
Name of the Vulnerable Software and Affected Versions Nexacro platform affected versions not specified Description The issue is related to insufficient verification of input data, which can lead to arbitrary file download and execution. This is caused by an automatic update function that fails to...
EulerOS Virtualization 2.10.1 : babel (EulerOS-SA-2022-1367)
According to the versions of the babel package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files containing serialized Python objects via...
CVE-2022-20739 Cisco SD-WAN vManage Software Privilege Escalation Vulnerability
A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as the root user. The attacker must be authenticated on the affected system as a low-privileged user to exploit this...
CVE-2022-20739
A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as the root user. The attacker must be authenticated on the affected system as a low-privileged user to exploit this...
Design/Logic Flaw
Zoo Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /publichtml/applyvacancy. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...