CVE-2023-6266

The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMIBACKUP case of the handledownloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download...

CVE-2023-6266 Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure

The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMIBACKUP case of the handledownloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download...

CVE-2023-6266 Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure

The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMIBACKUP case of the handledownloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download...

WordPress Plugin Backup Migration Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2023-49295 quic-go's path validation mechanism can cause denial of service

quic-go is an implementation of the QUIC protocol RFC 9000, RFC 9001, RFC 9002 in Go. An attacker can cause its peer to run out of memory sending a large number of PATHCHALLENGE frames. The receiver is supposed to respond to each PATHCHALLENGE frame with a PATHRESPONSE frame. The attacker can...

quic-go's path validation mechanism can be exploited to cause denial of service

An attacker can cause its peer to run out of memory sending a large number of PATHCHALLENGE frames. The receiver is supposed to respond to each PATHCHALLENGE frame with a PATHRESPONSE frame. The attacker can prevent the receiver from sending out the vast majority of these PATHRESPONSE frames by...

GHSA-PPXX-5M9H-6VXF quic-go's path validation mechanism can be exploited to cause denial of service

An attacker can cause its peer to run out of memory sending a large number of PATHCHALLENGE frames. The receiver is supposed to respond to each PATHCHALLENGE frame with a PATHRESPONSE frame. The attacker can prevent the receiver from sending out the vast majority of these PATHRESPONSE frames by...

Arbitrary File Upload

dilab/resumable.php is vulnerable to Arbitrary File Upload. The vulnerability arises due to a lack of file upload path validation within Resumable.php. An attacker can arbitrarily upload any non existing file on the filesystem...

CVE-2023-5991

The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server...

CVE-2023-5672

The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files...

CVE-2023-5672

The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files...

CVE-2023-5991

CVE-2023-5991 affects the Hotel Booking Lite WordPress plugin prior to 4.8.5. The issue arises from the plugin not validating user-supplied file paths and lacking proper CSRF/authorization checks, enabling unauthenticated attackers to download and delete arbitrary server files. Remediation is to ...

PT-2023-32253 · WordPress · Wp Mail Log

Name of the Vulnerable Software and Affected Versions: WP Mail Log WordPress plugin versions prior to 1.1.3 Description: The issue is related to the improper validation of file path parameters when attaching files to emails, leading to local file inclusion. This allows an attacker to leak the...

PT-2023-32464 · WordPress · Hotel Booking Lite

Name of the Vulnerable Software and Affected Versions: Hotel Booking Lite WordPress plugin versions prior to 4.8.5 Description: The issue arises from the plugin's failure to validate file paths provided via user input and its lack of proper CSRF and authorisation checks. This allows unauthenticat...

Path Traversal

Gradio is vulnerable for Path Traversal. The vulnerability is due to improper file path validation within the /file endpoint. An attacker can access arbitrary files on the server by requesting a filepath starting with...

Arbitrary File Write

mlflow is vulnerable to Arbitrary File Write. The vulnerability is caused to an inappropriate path validation in the validatepathissafe function. This allows an attacker to arbitrarily write files to the mlflow serve...

PT-2023-32692 · WordPress · Mw Wp Form

Name of the Vulnerable Software and Affected Versions: MW WP Form plugin for WordPress versions up to, and including, 5.0.3 Description: The issue arises from the plugin not properly validating the path of an uploaded file prior to deletion, allowing unauthenticated attackers to delete arbitrary...

Unbounded queuing of path validation messages in cloudflare-quiche

Impact quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path validation RFC 9000 Section 8.2 requires that the recipient of a PATHCHALLENGE frame responds by sending a...

GHSA-W3VP-JW9M-F9PM Unbounded queuing of path validation messages in cloudflare-quiche

Impact quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path validation RFC 9000 Section 8.2 requires that the recipient of a PATHCHALLENGE frame responds by sending a...

Input validation

quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path validation RFC 9000 Section 8.2 requires that the recipient of a PATHCHALLENGE frame responds by sending a PATHRESPONSE. ...