CVE-2022-0360 WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting

The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones either intentionnaly or not and lead to Stored Cross-Site Scripting issues...

rpm: RPM does not require subkeys to have a valid binding signature

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature."1 RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey t...

CVE-2021-44036

Team Password Manager aka TeamPasswordManager before 10.135.236 has a CSRF vulnerability during import...

CVE-2021-44036

Team Password Manager aka TeamPasswordManager before 10.135.236 has a CSRF vulnerability during import...

SIMATIC RTLS 输入验证错误漏洞

SIMATIC RTLS Locating Manager is used to configure, operate and maintain the SIMATIC RTLS unit, a real-time wireless positioning system that provides locating solutions. A denial of service vulnerability exists in Siemens SIMATIC RTLS Locating Manager, which arises from the application's inabilit...

CVE-2021-41578

mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicious mep file, then they gain the ability to write arbitrary files to OS locations where the user has permission. This would typically lead ...

CVE-2020-26564

ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have !ENTITY content, create a .xml file for a generic survey template containing a link to this .css file, and import this .xml file at the survey/admin/folderSurvey.do?action=viewImportSurvey'importFile'...

Import loops in account imports, nats-server DoS

This advisory is canonically Problem Description An export/import cycle between accounts could crash the nats-server, after consuming CPU and memory. This issue was fixed publicly in in November 2020. The need to call this out as a security issue was highlighted by snyk.io and we are grateful for...

CVE-2020-22785

Etherpad 1.8.3 is affected by a missing lock check which could cause a denial of service. Aggressively targeting random pad import endpoints with empty data would flatten all pads due to lack of rate limiting and missing ownership check...

Perforce Software Perforce Helix ALM 缓冲区错误漏洞

Perforce Software Perforce Helix ALM is an application software from Perforce Software, Inc. It provides application lifecycle management for products. Perforce Helix ALM 2020.3.1 Build 22 suffers from a buffer error vulnerability that originates from the XML import function of the management...

BloodHound Cross-Site Scripting Vulnerability

BloodHound is a JavaScript application that reveals hidden relationships and attack paths in the Active Directory environment through graph theory. A cross-site scripting vulnerability exists in Bloodhound. The vulnerability, which originates in the product's...

GitLab Input Validation Error Vulnerability (CNVD-2020-46485)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in the project import...

Cross site scripting

"HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy."...

WordPress wp-advanced-search SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.LearnPress is a learning management system plugin used in it. A SQL injection vulnerability exists in the import function in...

UBUNTU-CVE-2020-10941

Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information an RSA private key by measuring cache usage during an import...

UBUNTU-CVE-2019-12445

An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on notes by importing a specially crafted project file. It allows XSS...

CVE-2019-1348

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths...

BMC Smart Reporting XML External Entity Injection Vulnerability

BMC Smart Reporting is a smart reporting system. BMC Smart Reporting suffers from an XML External Entity Injection vulnerability that allows an authenticated attacker with administrator privileges to import a malicious XML file and perform an XXE attack to download a local file from a server, or...

CVE-2019-0367

SAP NetWeaver Process Integration B2B Toolkit, before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check...

WordPress LifterLMS plugin power lifting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. A vulnerability exists in the 'uploadimport' function in the class.llms.admin.import.php script in LifterLMS plugin version 3.34.5 and earlier. An attacker can exploit this vulnerability to...