GHSA-G3H8-CG9X-47QW Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5

Impact An editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors...

File upload vulnerability in DedeCMSV6 backend fi***_na***_co***.php file

DedeCMSV6 is based on PHP 7.x development, is scalable and fully open source. A file upload vulnerability exists in the DedeCMSV6 backend finaco.php file. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

The vulnerability of Cisco Webex Meetings Server and Cisco Webex Meetings software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the software user interfaces for Cisco Webex Meetings Server and Cisco Webex Meetings is related to improper access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Tencent Video (Windows Client) DLL Hijacking Vulnerability

Tencent video official free download is the client product of Tencent video, supporting rich content online VOD and live TV stations, providing list management, video volume amplification, color and picture quality adjustment, automatic shutdown and other more powerful features and services...

File Upload Vulnerability in DSS Safe City System of Zhejiang Dahua Technology Co.

Zhejiang Dahua Technology Co., Ltd, is the world's leading video-centered intelligent IOT solution provider and operation service provider, providing end-to-end video surveillance solutions, systems and services for city operations and more. A file upload vulnerability exists in the DSS Safe City...

Arbitrary File Upload Vulnerability in PowerCreator CMS

PowerCreator, founded in 2003, is an international enterprise providing software development and product manufacturing for the global audio/video industry. An arbitrary file upload vulnerability exists in PowerCreator CMS. An attacker can exploit this vulnerability to upload a webshell and gain...

Design/Logic Flaw

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can access, modify, and delete restricted files on the Orchestrator server using the/debugFiles REST API...

Wordpress EZ-done File Manager Remote File Upload Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A remote file upload vulnerability exists in Wordpress EZ-done File Manager. An attacker ca...

WordPress plugin Simple File List arbitrary file upload vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. An arbitrary file upload vulnerability exists in the WordPress plugin Simple File List. An...

CVE-2020-7757

This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server...

CVE-2020-25483

An arbitrary command execution vulnerability exists in the fopen function of file writes of UCMS v1.4.8, where an attacker can gain access to the server...

CVE-2020-25483

An arbitrary command execution vulnerability exists in the fopen function of file writes of UCMS v1.4.8, where an attacker can gain access to the server...

Command injection

An arbitrary command execution vulnerability exists in the fopen function of file writes of UCMS v1.4.8, where an attacker can gain access to the server...

PT-2020-16095

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.8 Description An arbitrary command execution issue exists in the fopen function of file writes, allowing an attacker to gain access to the server. Recommendations For UCMS version 1.4.8, consider restricting access to the fope...

Bubble Accelerator (Windows Client) Command Execution Vulnerability

Bubble Accelerator is an acceleration tool for games. Bubble Accelerator Windows client A command execution vulnerability exists. An attacker can exploit the vulnerability to remotely execute commands and gain server privileges...

CAD Quick Look - Editing Assistant pc client software has a command execution vulnerability

Quanta Technology Co., Ltd. is a listed software company, based on the field of construction engineering, centering on the whole life cycle of engineering projects, providing professional applications in the field of construction engineering as the core basic support, and value-added services suc...

Command Execution Vulnerability in Haozitong Cloud Conference PC Version

GoodVision Cloud Meeting for PC is a platform developed for video conferencing offices. A command execution vulnerability exists in GoodView Cloud Meeting PC Edition, which can be exploited by an attacker to gain control of the server...

Malicious Package

Overview All versions of plutov-slack-client contain malicious code. Upon installation the package opens a shell to a remote server. The package affects both Windows and nix systems. Recommendation Any computer that has this package installed or running should be considered fully compromised. All...

PT-2020-6346 · Schneider Electric · Communication Modules +3

Name of the Vulnerable Software and Affected Versions: Modicon M340 versions affected versions not specified Modicon Quantum versions affected versions not specified Modicon Premium Legacy versions affected versions not specified Communication Modules versions affected versions not specified...

Exploit for CVE-2018-2894

Weblogic CVE-2018-2894 CVE-2018-2894 0x01 前言 Oracle 7月更新中，修复了Weblogic Web Service Test Page中一处任意文件上传漏洞，Web Service Test Page 在“生产模式”下默认不开启，所以该漏洞有一定限制， 利用该漏洞，可以上传任意jsp文件，进而获取服务器权限。 0x02 漏洞环境 Ubuntu 16.04 https://github.com/vulhub/vulhub/blob/master/weblogic/CVE-2018-2894/ 执行如下命令，启动weblogic 12.2.1....