CVE-2022-0921

Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12...

PT-2022-13527

Name of the Vulnerable Software and Affected Versions microweber/microweber versions prior to 1.2.12 Description The issue allows a malicious actor to achieve Remote Code Execution by abusing the Backup/Restore feature. Recommendations For versions prior to 1.2.12, update to version 1.2.12 or lat...

CVE-2022-0921: Improper Control of Generation of Code

Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12...

GHSA-6H3M-36W8-HV68 Arbitrary file write in nats-server

This document is canonically: Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. JetStream is the optional RAFT-based resilient persistent feature of NATS. Problem Description The JetStream...

Abusing Backup/Restore feature to achieve Remote Code Execution

Description Admin can use Backup modules to upload a malicious PHP file, which can lead to RCE. Proof of Concept + Log in as admin, navigate to Modules - Backup: https://demo.microweber.org/demo/admin/view:modules/loadmodule:adminbackup + Prepare a malicious PHP file, in this case info2.php +...

Exploit for Improper Initialization in Linux Linux_Kernel

CVE-2022-0847-dirty-pipe-exploit An exploit for CVE-2022-0847...

Exploit for Improper Initialization in Linux Linux_Kernel

What is this This is Max Kellermann's proof of concept for Di...

CVE-2022-24254

An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file...

CVE-2022-24254

An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file...

CVE-2022-24254

An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file...

PT-2022-16567

Name of the Vulnerable Software and Affected Versions Extensis Portfolio version 4.0 Description The issue allows remote attackers to execute arbitrary code via a crafted ZIP file, exploiting an unrestricted file upload vulnerability in the Backup/Restore Archive component. Recommendations For...

CVE-2022-24254: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the AnyComment plugin for WordPress, versions...

CVE-2021-43952

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery CSRF vulnerability in the /secure/admin/RestoreDefaults.jspa endpoint. The affected versions are before version 8.21.0...

CVE-2021-43952

CVE-2021-43952 affects Atlassian Jira Server and Data Center. A cross-site request forgery (CSRF) vulnerability on /secure/admin/RestoreDefaults.jspa allows unauthenticated actors to restore the default configuration of fields. Affected versions are before 8.21.0. Connected documents corroborate ...

PT-2022-11952

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 8.21.0 Description The issue allows unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery CSRF vulnerability in the...

CVE-2021-43952: Cross-Site Request Forgery (CSRF)

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery CSRF vulnerability in the /secure/admin/RestoreDefaults.jspa endpoint. The affected versions are before version 8.21.0...

Zip slip in Microweber

A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously...

GHSA-PQCF-V8V5-JMCG Zip slip in Microweber

A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously...

Acronis True Image Competitive Conditions Issue Vulnerability

Acronis True Image is a well-known data backup and restore software from Singapore-based Acronis. The software can be used to create drive and disk images and can restore images when a clean system is needed.Acronis True Image suffers from a competing condition issue vulnerability that can be...