Cisco Nexus Dashboard Fabric Controller 安全漏洞

The Cisco Nexus Dashboard Fabric Controller is a comprehensive network management platform from Cisco for managing Cisco NX-OS deployments for LAN, SAN, and IP Fabric for Media IPFM networks in data centers. A code execution vulnerability exists in the Cisco Nexus Dashboard Fabric Controller that...

Remote Code Execution

Camaleon CMS is vulnerable to Remote Code Execution. The vulnerability is due to insufficient path validation in the MediaController class, allowing attackers, after taking over an administrator account, to delete arbitrary files or folders. Additionally, the cropurl action may allow arbitrary fi...

CVE-2024-8671

The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path validation in the inc/barcode.php file in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to overwrite arbitrary...

CVE-2024-8671

The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path validation in the inc/barcode.php file in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to overwrite arbitrary...

CVE-2024-8671

The CVE-2024-8671 entry concerns WordPress plugin WooEvents – Calendar and Event Booking. Affected versions (up to 4.1.2) are vulnerable to arbitrary file overwrite due to insufficient file path validation in inc/barcode.php, enabling unauthenticated attackers to overwrite server files and potent...

Path Traversal

Camaleon CMS is vulnerable to Path Traversal. The vulnerability is due to insufficient path validation in the MediaController's downloadprivatefile method, allowing authenticated users to download any file on the server, depending on file permissions...

Relative Path Traversal

@backstage/plugin-techdocs-backend is vulnerable to Relative Path Traversal. The vulnerability is caused due to improper validation of file paths, allowing unauthorized access to files in the AWS S3 or GCS storage provider...

Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)

The actions defined inside of the MediaController class do not check whether a given path is inside a certain path e.g. inside the media folder. If an attacker performed an account takeover of an administrator account See: GHSL-2024-184 they could delete arbitrary files or folders on the server...

CVE-2022-25769

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path...

CVE-2024-7864

The Favicon Generator CLOSED WordPress plugin before 2.1 does not have CSRF and path validation in the outputsubadminpage0 function, allowing attackers to make logged in admins delete arbitrary files on the server...

CVE-2024-7864

The Favicon Generator CLOSED WordPress plugin before 2.1 does not have CSRF and path validation in the outputsubadminpage0 function, allowing attackers to make logged in admins delete arbitrary files on the server...

CVE-2024-7864

The CVE concerns the WordPress Favicon Generator plugin (versions prior to 2.1). A lack of CSRF protection and insufficient path validation in the output_sub_admin_page_0() function allows an attacker to induce logged-in admins to delete arbitrary files on the server. Impact is high for integrity...

CVE-2024-7864 Favicon Generator < 2.1 - Arbitrary File Deletion via CSRF

The Favicon Generator CLOSED WordPress plugin before 2.1 does not have CSRF and path validation in the outputsubadminpage0 function, allowing attackers to make logged in admins delete arbitrary files on the server...

WordPress plugin Favicon Generator 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...

PT-2024-38641 · WordPress · The Favicon Generator

Name of the Vulnerable Software and Affected Versions: The Favicon Generator CLOSED WordPress plugin versions prior to 2.1 Description: The issue concerns a lack of CSRF and path validation in the output sub admin page 0 function. This allows attackers to make logged-in admins delete arbitrary...

CVE-2024-7626

The WP Delicious – Recipe Plugin for Food Bloggers formerly Delicious Recipes plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the saveeditprofiledetails function in all versions up to, and including, 1.6.9. This makes it possib...

CVE-2024-7626 WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read

The WP Delicious – Recipe Plugin for Food Bloggers formerly Delicious Recipes plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the saveeditprofiledetails function in all versions up to, and including, 1.6.9. This makes it possib...

CVE-2024-7626 WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read

The WP Delicious – Recipe Plugin for Food Bloggers formerly Delicious Recipes plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the saveeditprofiledetails function in all versions up to, and including, 1.6.9. This makes it possib...

CVE-2024-7626

CVE-2024-7626 affects WP Delicious – Recipe Plugin for WordPress (formerly Delicious Recipes), versions ≤ 1.6.9. The vulnerability stems from insufficient file path validation in the save_edit_profile_details() function, allowing authenticated users with subscriber-level access and above to move ...

WordPress WP Delicious plugin <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read vulnerability

Improper Path Validation to Authenticated Subscriber+ Arbitrary File Move and Read vulnerability discovered by Connor Billings in WordPress Plugin WP Delicious versions = 1.6.9...