3309 matches found
CVE-2023-51421
CVE-2023-51421 affects Verge3D Publishing and E-Commerce (Soft8Soft) with an Unrestricted Upload of File with Dangerous Type vulnerability. Affected versions: Verge3D Publishing and E-Commerce up to 4.5.2. Root cause: unrestricted file upload potentially allows remote code execution or scripting ...
WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE
Description The plugin accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code...
WordPress plugin WP Mail Log security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability in the...
PYSEC-2023-279
MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which...
Design/Logic Flaw
An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could permit an adversary in the middle attack when combined with other phishing techniques. To exploit this, an attacker would need access to the...
CVE-2023-6746 Sensitive Information in Log File in GitHub Enterprise Server
An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could permit an adversary in the middle attack when combined with other phishing techniques. To exploit this, an attacker would need access to the...
PT-2023-32755 · Github · Github Enterprise Server
Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.7.19 GitHub Enterprise Server versions prior to 3.8.12 GitHub Enterprise Server versions prior to 3.9.7 GitHub Enterprise Server versions prior to 3.10.4 GitHub Enterprise Server versions prior to...
CVE-2023-33318
Unrestricted Upload of File with Dangerous Type vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.40...
PT-2023-31494 · Trimble · Trimble Sketchup Viewer
Name of the Vulnerable Software and Affected Versions: Trimble SketchUp Viewer affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability...
PT-2023-31492 · Trimble · Trimble Sketchup Viewer
Name of the Vulnerable Software and Affected Versions: Trimble SketchUp Viewer affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this issue, where...
PT-2023-31495 · Trimble · Trimble Sketchup Viewer
Name of the Vulnerable Software and Affected Versions: Trimble SketchUp Viewer affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this, as the targe...
gstreamer: MXF demuxer use-after-free vulnerability
A use-after-free flaw was found in the MXF demuxer in GStreamer when handling certain MXF video files. This issue could allow a malicious third party to trigger a crash in the application and may allow code execution...
ZKTeco ZKBio Time Security Vulnerability
ZKTeco ZKBio Time is a powerful web-based time and attendance management software from China-based ZKTeco. Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance A security vulnerability exists in versions 13.0 through 16.0.1, which stems from an SQL injection...
OpenCart config.php Code Execution
The vulnerability of the config.php script on the OpenCart e-commerce platform relates to the possibility of introducing code or data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the base server...
Voovi Security Breach
Voovi is an open source social networking script from Sourceforge. A security vulnerability exists in Voovi version 1.0, which stems from a SQL injection vulnerability in update.php...
SMPN 1 Semarang absis security vulnerability
absis is an open source web-based K13/KTSP academic system from SMPN 1 Semarang. A security vulnerability exists in SMPN 1 Semarang absis v.2017-10-19 and earlier versions, which stems from a cross-site scripting XSS vulnerability in the user parameter of the lock/lock.php file...
PT-2023-32412 · WordPress · Job Manager & Career
Name of the Vulnerable Software and Affected Versions: Job Manager & Career WordPress plugin versions prior to 1.4.4 Description: The issue allows an unauthorized user to view and download private files of other users due to a vulnerability in the Directory Listings system. This poses a serious...
TONGDA Office Anywhere SQL Injection Vulnerability
TONGDA Office Anywhere is a collaborative office OA system. A SQL injection vulnerability exists in TONGDA Office Anywhere 2017 11.9 and earlier versions, which stems from the parameter PROJIDSTR in the file general/wiki/cp/ct/delete.php that can lead to SQL injection...
