SUSE CVE-2017-5630

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite...

SUSE CVE-2017-9798

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...

qdPM 9.1 Authenticated Shell Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'qdPM 9.1 Authenticated Arbitrary PHP File Upload RCE', 'Description' = %q A remote code execution RCE vulnerability exists in qdPM 9.1 and earlie...

Rocket LMS 1.6 Shell Upload Vulnerability

Exploit Title: Rocket LMS - Learning Management System Shell Upload Exploit Author: th3d1gger Vendor Homepage: https://codecanyon.net Software Link: https://codecanyon.net/item/rocket-lms-learning-management-academy-script/33120735 Version: Version 1.6 Tested on Ubuntu 18.04 base64 encode your...

Remote Code Execution

drupal/core is vulnerable to remote code execution. A remote attacker is able to bypass protections provided in sanitizeName function because the filenames with .htaccess extension are not properly sanitized, which allows the attacker to upload and execute malicious code on the system under attac...

GHSA-6955-67HM-VJJQ Drupal core arbitrary PHP code execution

Drupal core sanitizes filenames with dangerous extensions upon upload and strips leading and trailing dots from filenames to prevent uploading server configuration files. However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site we...

Drupal 9.4.x < 9.4.3 Multiple Vulnerabilities

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.91, 9.3.x prior to 9.3.19 or 9.4.x prior to 9.4.3. It is, therefore, affected by multiple vulnerabilities: - In some situations, the Image module does not correctly check access to...

DRUPAL-CORE-2022-014

Updated 2022-07-20 19:45 UTC to indicate that this only affects Apache web servers. Drupal core sanitizes filenames with dangerous extensions upon upload reference: SA-CORE-2020-012 and strips leading and trailing dots from filenames to prevent uploading server configuration files reference:...

PT-2022-3918 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal core versions 7, 9.3, and 9.4 Description: The issue arises from the incorrect interaction between two protections in Drupal core: one that sanitizes filenames with dangerous extensions upon upload and another that strips leading and...

PayPal phishing campaign goes after more than just your login credentials

A new phishing campaign targeting PayPal users aims to get extensive data from potential victims. The data its after includes government documents like passport, as well as selfie photos. In a nutshell, its an extensive form of information theft, the likes of which could result in someones identi...

CVE-2021-37770

Nucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use upload to change the upload path to the path without the Htaccess file. Upload an Htaccess file and write it to AddType application / x-httpd-php.jpg. In this way, an attacker can upload a picture with...

Privilege escalation

Nucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use upload to change the upload path to the path without the Htaccess file. Upload an Htaccess file and write it to AddType application / x-httpd-php.jpg. In this way, an attacker can upload a picture with...

Private Files <= 0.40 - Protection Disabling via CSRF

The plugin is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public PoC That will also delete the .htaccess...

Private Files <= 0.40 - Protection Disabling via CSRF

The plugin is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public document.getElementById"test".submit; That will also delete the .htaccess...

GHSA-23GJ-X27G-R34F MODX Revolution allows overwriting .htaccess

In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess...

MODX Revolution allows overwriting .htaccess

In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess...

pgpbuilder (>=0.3.6 <=0.6.0), pgpmailer (>=0.3.8 <=0.9.1) +5 more potentially affected by CVE-2015-8013 via openpgp (>=0.11.1 <=0.8.2)

openpgp NPM version =0.11.1, =0.3.6, =0.3.8, =0.0.1, =0.1.0, =0.5.6, =0.15.0, =0.24.1 Source cves: CVE-2015-8013 Source advisory: OSV:GHSA-QMVQ-F3FJ-M3WG...

Subrion CMS Cross-site Scripting

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads but does block, for example, .htm file uploads...

GHSA-VHQR-3GR2-7PX9 Subrion CMS Cross-site Scripting

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads but does block, for example, .htm file uploads...

Mediawiki tarball is missing .htaccess files

Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible...