3787 matches found
Super Forms < 4.9.703 - Unauthenticated PHP File Upload to RCE
The plugin uses the jQuery File Upload library, but does not properly ensure that PHP files are forbidden. Note: Exploitation of the issue is not as easy as the original advisory in the references states. If a form from the plugin with an upload field is present on the blog, and is used to upload...
WordPress Super Forms premium plugin <= 4.9.700 - Arbitrary File Upload leading to Remote Code Execution (RCE) vulnerability
Arbitrary File Upload leading to Remote Code Execution RCE vulnerability found by ABDO10 in WordPress Super Forms premium plugin versions = 4.9.700. Solution Update the WordPress Super Forms premium plugin to the latest available version at least 4.9.703...
WordPress Super Forms Bundle premium plugin <= 4.9.700 - Arbitrary File Upload leading to Remote Code Execution (RCE) vulnerability
Arbitrary File Upload leading to Remote Code Execution RCE vulnerability found by ABDO10 in WordPress Super Forms Bundle premium plugin versions = 4.9.700. Solution Update the WordPress Super Forms Bundle premium plugin to the latest available version at least 4.9.703...
SmartAgent Security Vulnerabilities
A security vulnerability exists in SmartAgent 3.1.0 that can be exploited by an attacker to create Super Administrators via //CampaignManager/users...
File upload vulnerability exists in super cms (CNVD-2021-03275)
Super CMS is a content management system. A file upload vulnerability exists in super cms, which can be exploited by attackers to gain control of the server...
CVE-2018-16795
OpenEMR 5.0.1.3 allows Cross-Site Request Forgery CSRF via library/ajax and interface/super, as demonstrated by use of interface/super/managesitefiles.php to upload a .php file...
CVE-2018-16795
OpenEMR 5.0.1.3 allows Cross-Site Request Forgery CSRF via library/ajax and interface/super, as demonstrated by use of interface/super/managesitefiles.php to upload a .php file...
OpenEMR 跨站请求伪造漏洞
OpenEMR is an open source medical management system from the OpenEMR Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A cross-site request forgery vulnerability exists in OpenEMR version...
PT-2020-8564
Name of the Vulnerable Software and Affected Versions: OpenEMR version 5.0.1.3 Description: The issue allows Cross-Site Request Forgery CSRF via library/ajax and interface/super. This can be demonstrated by using the interface/super/manage site files.php endpoint to upload a .php file...
CVE-2018-16795: Cross-Site Request Forgery (CSRF)
OpenEMR 5.0.1.3 allows Cross-Site Request Forgery CSRF via library/ajax and interface/super, as demonstrated by use of interface/super/managesitefiles.php to upload a .php file...
Linux: Read /etc/inetd.* and /etc/xinetd.* files
xinetd performs the same function as inetd: it starts programs that provide Internet services. Instead of having such servers started at system initialization time, and be dormant until a connection request arrives, xinetd is the only daemon process started and it listens on all service ports for...
kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c
A flaw was found in the Linux kernel's ext4unlink function. An attacker could corrupt memory or escalate privileges when deleting a file from a recently unmounted specially crafted ext4 filesystem, including local, USB, and iSCSI...
Privilege Escalation
Super is vulnerable to privilege escalation. The vulnerability existed because it does not check the return value of the setuid function when the -F flag is set, which allows local users to gain privileges via unspecified vectors...
Super Backup 2.0.5 Directory Traversal
Document Title: =============== Super Backup v2.0.5 iOS - Directory Traversal Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2200 Release Date: ============= 2020-04-30 Vulnerability Laboratory ID VL-ID: ==================================...
Elastic: Async search stores authorization headers in clear text
Summary: The .async-search index stores the results of async searches. It also stores a copy of the requests authorization headers, in clear text. These clear text authorization headers are then available to anyone with access to .async-search, probably mostly super users. Description: While you...
kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c
A flaw was found in the Linux kernel's ext4unlink function. An attacker could corrupt memory or escalate privileges when deleting a file from a recently unmounted specially crafted ext4 filesystem, including local, USB, and iSCSI...
IBM Cognos Controller Elevation of Privilege Vulnerability
IBM Cognos Controller is a suite of business intelligence and planning solutions from IBM in the United States. The product features process automation, financial audit control, and the creation and management of financial reports. IBM Cognos Controller suffers from a security vulnerability that...
RED-V Super Digital Signage System RXV-A740R Log Information Disclosure
RED-V Super Digital Signage System RXV-A740R Log Information Disclosure Vendor: RED-V S.R.L. Product web page: https://www.red-v.tv https://red-v.tv/digital-signage.html Affected version: Model name: RXV-A740R Android version: 5.1.1 Firmware version: 026 Player version: 7.8.6 Downloader version:...
Super Store Finder 3.3 Cross Site Scripting
Exploit type : XSS INJECTION Exploit title : Super Store Finder Add location XSS Injection Descriptions : XSS injection from adding store and reflected XSS in SQL error login page PHP Script affected : Super Store Finder | Mega Locator Plugin URI : http://www.superstorefinder.net/ Version : 3.3 a...
RED-V Super Digital Signage System RXV-A740R Log Information Disclosure
Summary RED-V Super Digital Signage transforms simple screens into customized TV channels, delivering audiovisual communication as immersive user experiences. It is the final blending of years of know-how in multimedia, mobile and web experience, tablet and multimedia server design. Description T...