CVE-2020-12104: Improper Neutralization of Special Elements used in an SQL Command

The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation...

PT-2020-19251 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab Enterprise Edition versions 8.9.0 through 12.6.1 Description: An issue was discovered that allows someone to obtain issues from private projects using the project import feature. Recommendations: For GitLab Enterprise Edition versions...

PT-2019-18946

Name of the Vulnerable Software and Affected Versions Magento versions prior to 1.9.4.3 Magento versions prior to 1.14.4.3 Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 Magento 2.3 version 2.3.2-p1 Description The issue allows an authenticated user with administrative...

CVE-2019-8232: Concurrent Execution using Shared Resource with Improper Synchronization

In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file...

CVE-2019-7930

A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to the import feature can make modifications to a configuration file, resulting in potentially unauthorized removal o...

PT-2019-18832

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions 2.1.0 through 2.1.17 Magento 2.2 versions 2.2.0 through 2.2.8 Magento 2.3 versions 2.3.0 through 2.3.1 Description A file upload restriction bypass issue exists, allowing an authenticated user with administrator privileges...

CVE-2019-7930: Unrestricted Upload of File with Dangerous Type

A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to the import feature can make modifications to a configuration file, resulting in potentially unauthorized removal o...

CVE-2018-15906

SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifying a CSV file...

Design/Logic Flaw

SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifying a CSV file...

CVE-2018-15906

CVE-2018-15906 affects SolarWinds Serv-U FTP Server 15.1.6. A remote authenticated user can exploit the Import feature by modifying a CSV, enabling privilege escalation to SYSTEM and remote code execution on default Windows installations. Documented impact includes escalation from Domain Administ...

CVE-2018-15906

SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifying a CSV file...

PT-2019-9199

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U FTP Server version 15.1.6 Description The issue allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifying a CSV file. Recommendations For SolarWinds Serv-U FTP Server version...

CVE-2018-15906: Undefined Security Weakness

SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifying a CSV file...

Cross site scripting

An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature...

CVE-2018-15605

An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature...

CVE-2018-15605

An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature...

CVE-2018-15605

An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature...

CVE-2018-15605: Improper Neutralization of Input During Web Page Generation

An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature...

PT-2018-13112

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.8.3 Description A Cross-Site Scripting issue has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature. Recommendations For version...

PT-2018-15571

Name of the Vulnerable Software and Affected Versions SAP SRM MDM Catalog versions 3.73, 7.31, 7.32 Description The issue concerns an unauthenticated functionality in the import feature that fails to perform authentication checks for valid repository users. This can be exploited on Windows machin...