13779 matches found
CVE-2022-0679 Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE
The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the libpath parameter before it is passed into a call to require via the narnoodistributorlibrequest AJAX action available to both unauthenticated and authenticated users which results in the disclosure of...
CVE-2022-0679
CVE-2022-0679 affects the WordPress Narnoo Distributor plugin (versions = 2.5.2) or apply vendor-provided patches. If upgrading is not possible, mitigate where feasible by reviewing the handling of lib_path, access controls for the AJAX action, and server file permissions. This CVE description is...
CVE-2021-24962 WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE
The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in...
CVE-2022-26258
D-Link DIR-820L 1.05B03 was discovered to contain remote command execution RCE vulnerability via HTTP POST to get set ccp...
Command injection
D-Link DIR-820L 1.05B03 was discovered to contain remote command execution RCE vulnerability via HTTP POST to get set ccp...
Tatsu < 3.3.12 - Unauthenticated RCE
The plugin addcustomfont action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Moreover,...
Tatsu < 3.3.12 - Unauthenticated RCE
The plugin addcustomfont action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Moreover,...
Microsoft Office 365 Apps for Enterprise RCE Vulnerability (Nov 2021)
This host is missing an important security update according to Microsoft Office Click-to-Run updates SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
Microsoft Office 365 (2019 Click-to-Run) Multiple RCE Vulnerabilities (Oct 2021)
This host is missing an important security update according to Microsoft Office Click-to-Run updates SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
Microsoft Office 365 (2019 Click-to-Run) Multiple RCE Vulnerabilities (Sep 2021)
This host is missing an important security update according to Microsoft Office Click-to-Run updates SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
CVE-2021-44127
CVE-2021-44127 affects D-Link DAP-1360 F1 firmware versions <= v6.10. In the webupg binary, the attacker can use the file parameter with name=deleteFile after authorization to execute arbitrary system commands. This is documented across multiple sources (NVD entry and CNVD/CVE mirrors). The ex...
CVE-2022-26205
CVE-2022-26205 is associated with the Marky project. The vulnerability is a remote code execution (RCE) via the Display text fields, allowing an attacker to inject a crafted payload to execute arbitrary code. Red Hat and other records corroborate the RCE via Marky commit 3686565726c65756e. Exploi...
Admin Word Count Column <= 2.2 - Unauthenticated Arbitrary File Read
The plugin does not validate the path parameter given to readfile, which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique PoC...
CVE-2022-26258
CVE-2022-26258 affects D-Link DIR-820L devices (firmware around 1.05B03). Multiple open‑source scanners and NVD entries describe a remote code execution (RCE) vulnerability in this model, with initial reports citing an RCE via HTTP POST to get set ccp and separate notes of an RCE via the Device N...
PDF Generator Web App Using TCPDF 1.0 Local File Inclusion
Title: PDF Generator Web App using TCPDF 1.0 LFI To RCE Author: Hejap Zairy Date: 26.07.2022 Vendor: https://www.sourcecodester.com/php/15243/pdf-generator-web-app-using-tcpdf-and-phpoop-free-source-code.html...
CVE-2022-27919
CVE-2022-27919 affects Gradle Enterprise prior to 2022.1. The issue allows remote code execution when the installation process omits an initial configuration file, because the configuration enables anonymous access to administration and the API. Impact is demonstrated as remote code execution wit...
Google Chrome Zero-Day Bugs Exploited Weeks Ahead of Patch
North Korean threat actors exploited a remote code execution RCE zero-day vulnerability in Google’s Chrome web browser weeks before the bug was discovered and patched, according to researchers. Google Threat Analysis Group TAG discovered the flaw, tracked as CVE-2022-0609, on Feb. 10, reporting a...
Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands...
TIBCO Security Advisory: March 30, 2022 - TIBCO Managed File Transfer Platform Server -2022-22772
TIBCO Managed File Transfer Platform Server Remote Code Execution Vulnerability Original release date: March 30,2022 Last revised: --- CVE-2022-22772 Source: TIBCO Software Inc. Products Affected TIBCO Managed File Transfer Platform Server for UNIX versions 8.1.0 and below TIBCO Managed File...
TIBCO Security Advisory: March 30, 2022 - TIBCO Managed File Transfer Platform Server -2022-22772
TIBCO Managed File Transfer Platform Server Remote Code Execution Vulnerability Original release date: March 30,2022 Last revised: --- CVE-2022-22772 Source: TIBCO Software Inc. Products Affected TIBCO Managed File Transfer Platform Server for UNIX versions 8.1.0 and below TIBCO Managed File...