292 matches found
PT-2024-6000 · Adobe · Commerce
Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier Description: The issue is related to an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage...
PT-2024-6005 · Adobe · Commerce
Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS Command Injection', which could lead to...
Information leakage vulnerability in NVR301-08-P8 of Zhejiang Yushu Technology Co.
NVR301-08-P8 is an NVR video recorder device produced by Zhejiang Yusi Technology Co. Ltd. NVR301-08-P8 suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...
Magento Open Source Improper Access Control vulnerability
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of...
CVE-2024-34104 Adobe Commerce | Improper Authorization (CWE-285)
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both...
CVE-2024-34102
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ‘XXE’ vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that...
PT-2024-4485 · Adobe · Commerce
Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read and potentially result in arbitrary co...
PT-2024-4177 · Adobe · Commerce
Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which could result in arbitrary code execution. A high-privilege attacker could...
Improper Input Validation
Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Input Validation due to improper input validation. An attacker can execute arbitrary code in the context of the current user by sending specially crafted input to...
New SPECTRALVIPER Backdoor Targeting Vietnamese Public Companies
Vietnamese public companies have been targeted as part of an ongoing campaign that deploys a novel backdoor called SPECTRALVIPER. "SPECTRALVIPER is a heavily obfuscated, previously undisclosed, x64 backdoor that brings PE loading and injection, file upload and download, file and directory...
Security Bulletin: An Apache Commons Compress vulnerability has been identified with the embedded IBM FileNet P8 Content Platform Engine component in IBM Business Process Manager and IBM Business Automation Workflow
Summary An Apache Commons Compress vulnerability has been identified with the embeded IBM FileNet P8 Content Platform Engine component, specifically with the Administration Console for Content Platform Engine application, in IBM Business Process Manager and IBM Business Automation Workflow...
CVE-2022-33085
ESPCMS P8 was discovered to contain an authenticated remote code execution RCE vulnerability via the fetchfilename function at \espcmspublic\espcmstemplates\ESPCMSTemplates...
CVE-2022-33085
ESPCMS P8 was discovered to contain an authenticated remote code execution RCE vulnerability via the fetchfilename function at \espcmspublic\espcmstemplates\ESPCMSTemplates...
Remote code execution
ESPCMS P8 was discovered to contain an authenticated remote code execution RCE vulnerability via the fetchfilename function at \espcmspublic\espcmstemplates\ESPCMSTemplates...
CVE-2022-33085
ESPCMS P8 was discovered to contain an authenticated remote code execution RCE vulnerability via the fetchfilename function at \espcmspublic\espcmstemplates\ESPCMSTemplates...
CVE-2022-33085
ESPCMS P8 is affected by an authenticated remote code execution (RCE) vulnerability in the fetch_filename function under espcms_public/espcms_templates/ESPCMS_Templates. The Red Hat advisory and related records corroborate the issue, describing an authenticated RCE path via that function. No prod...
CVE-2022-33085: Undefined Security Weakness
ESPCMS P8 was discovered to contain an authenticated remote code execution RCE vulnerability via the fetchfilename function at \espcmspublic\espcmstemplates\ESPCMSTemplates...
PT-2022-21681
Name of the Vulnerable Software and Affected Versions ESPCMS P8 Description The issue is an authenticated remote code execution vulnerability. It occurs via the fetch filename function located at espcms publicespcms templatesESPCMS Templates. Recommendations For ESPCMS P8, consider disabling the...