CVE-2020-15849

Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for...

Sql injection

Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for...

CVE-2020-15849

Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for...

CVE-2020-21564

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...

CVE-2020-21564

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...

CVE-2020-15487

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution i...

Unrestricted file upload

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...

Sql injection

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution i...

CVE-2020-15487

Re:Desk 2.3 contains a blind unauthenticated SQL injection in getBaseCriteria() (protected/models/Ticket.php). By altering the folder GET parameter in a crafted URL, arbitrary SQL can be executed, enabling unauthenticated remote command execution via a bizRule eval() in yii/framework/web/auth/CAu...

CVE-2020-15487

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution i...

CVE-2020-21564

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...

CVE-2020-21564

CVE-2020-21564 concerns Pluck CMS versions 4.7.10-dev2 and 4.7.11, where a file upload vulnerability can lead to remote command execution via the endpoint admin.php?action=files. The sources provided describe the vulnerability but do not specify additional technical details, exploit status, affec...

CVE-2020-21564

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...

CVE-2020-15487: Improper Neutralization of Special Elements used in an SQL Command

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution i...

CVE-2020-21564: Unrestricted Upload of File with Dangerous Type

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...

PT-2020-14454

Name of the Vulnerable Software and Affected Versions Re:Desk version 2.3 Description The issue concerns a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function. This vulnerability can be exploited by modifying the folder GET parameter in a crafted URL, allowing for th...

PT-2020-15374

Name of the Vulnerable Software and Affected Versions Pluck CMS versions 4.7.10-dev2 through 4.7.11 Description The issue is related to a file upload vulnerability that can lead to remote command execution. This can be achieved via the "admin.php?action=files" endpoint. The vulnerability allows f...

PT-2020-14667

Name of the Vulnerable Software and Affected Versions Re:Desk version 2.3 Description The issue allows a malicious actor with administrative access to exploit a blind authenticated SQL injection vulnerability in the SettingsController class, specifically in the actionEmailTemplates method. This...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2020-2078)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Index.js Clamav Binary Command Execution

The vulnerability of the isclamavbinary function in Index.js of the antivirus scanner clamscan exists because special elements are not properly neutralized. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...