3552 matches found
PT-2022-18851 · Jenkins · Jenkins Job/Node Ownership Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Job and Node ownership Plugin versions 0.13.0 and earlier Description: A cross-site request forgery CSRF issue allows attackers to restore the default ownership of a job. This can be exploited by attackers to potentially gain...
CVE-2022-24426
Dell Command | Update, Dell Update, and Alienware Update version 4.4.0 contains a Local Privilege Escalation Vulnerability in the Advanced Driver Restore component. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation...
Veeam Backup for Microsoft 365 Restore Portal Error: "The server has rejected the client credentials"
Challenge When attempting to login to the Veeam Backup for Microsoft 365 Restore Portal, the following error occurs: The server has rejected the client credentials. Cause At this time, there are three known scenarios that may cause this issue: Scenario 1: Certificate not added to the Trusted Root...
PT-2022-3186
Name of the Vulnerable Software and Affected Versions TP-Link Archer AX50 AX3000 versions 210730 and older Description The issue is related to insufficient input validation in the implementation of the backup and restore functionality of the TP-Link Archer AX50 AX3000 router's web interface. This...
Remote Code Execution (RCE)
microweber is vulnerable to remote code execution. The vulnerability exists due a lack of verification of a zip file in the Backup/Restore feature, allowing an attacker to inject maliciously crafted script into the system...
Security Bulletin: Vulnerability in Flask and Python affects IBM Spectrum Protect Plus Microsoft File Systems Backup and Restore (CVE-2021-33026, CVE-2022-0391)
Summary Elevation of privileges vulnerability in Flask and weaker than expected security in Python can affect IBM Spectrum Protect Plus Microsoft® File Systems backup and restore. Vulnerability Details CVEID: CVE-2021-33026 DESCRIPTION: Flask-Caching extension for Flask could allow a local...
GHSA-J878-43HM-8GR5 Unrestricted Upload of File with Dangerous Type in Microweber
In Microweber prior to 1.2.12, a malicious actor may abuse the Backup/Restore feature to achieve Remote Code Execution...
CVE-2022-0921
Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0921
Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12...
Design/Logic Flaw
Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0921 Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber
Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0921 Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber
Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12...
GHSA-6H3M-36W8-HV68 Arbitrary file write in nats-server
This document is canonically: Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. JetStream is the optional RAFT-based resilient persistent feature of NATS. Problem Description The JetStream...
Abusing Backup/Restore feature to achieve Remote Code Execution
Description Admin can use Backup modules to upload a malicious PHP file, which can lead to RCE. Proof of Concept + Log in as admin, navigate to Modules - Backup: https://demo.microweber.org/demo/admin/view:modules/loadmodule:adminbackup + Prepare a malicious PHP file, in this case info2.php +...
Exploit for Improper Initialization in Linux Linux_Kernel
CVE-2022-0847-dirty-pipe-exploit An exploit for CVE-2022-0847...
Exploit for Improper Initialization in Linux Linux_Kernel
What is this This is Max Kellermann's proof of concept for Di...
CVE-2022-24254
An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file...
CVE-2022-24254
An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file...
CVE-2022-24254
An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file...
WordPress 跨站请求伪造漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the AnyComment plugin for WordPress, versions...