Remote code execution

A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...

PT-2022-27696 · Baijiacms · Baijiacms

Name of the Vulnerable Software and Affected Versions: baijiacms version v4 Description: A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php. Recommendations: For baijiacms version v4, consider restricting access to the includes/baijiacms/common.inc.php file...

CVE-2022-45942

A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...

CVE-2022-46139

Summary : CVE-2022-46139 affects TP-Link TL-WR940N V4, specifically versions 3.16.9 and earlier. The issue allows an authenticated attacker to trigger a Denial of Service by uploading a crafted firmware image during the firmware update process. What’s affected : The vulnerable device is the TP-Li...

CVE-2022-46139: Insufficient Verification of Data Authenticity

TP-Link TL-WR940N V4 3.16.9 and earlier allows authenticated attackers to cause a Denial of Service DoS via uploading a crafted firmware image during the firmware update process...

CVE-2022-45942

A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...

CVE-2020-36565 Directory traversal on Windows in github.com/labstack/echo/v4

Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...

Cross site request forgery (csrf)

perfSONAR v4.x = v4.4.5 was discovered to contain a Cross-Site Request Forgery CSRF which is triggered when an attacker injects crafted input into the Search function...

CVE-2022-41413

CVE-2022-41413 affects perfSONAR v4.x through v4.4.5, with a Cross-Site Request Forgery (CSRF) vulnerability triggered when crafted input is injected into the Search function. The issue is a partial blind CSRF that can cause the client to issue background requests to arbitrary URLs, bypassing the...

CVE-2022-37197

IOBit IOTransfer V4 is vulnerable to Unquoted Service Path...

Path traversal

IOBit IOTransfer V4 is vulnerable to Unquoted Service Path...

CVE-2022-37197

IOBit IOTransfer V4 is vulnerable to Unquoted Service Path...

CVE-2022-37197

CVE-2022-37197 concerns IOBit IOTransfer V4 with an Unquoted Service Path, specifically the IOTUpdaterSvc binary path (C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe). Public sources (NVD/Red Hat/CVE lists, Exploit-DB, PT Security) confirm a local vulnerability where an unquoted service...

CVE-2022-37197: Unquoted Search Path or Element

IOBit IOTransfer V4 is vulnerable to Unquoted Service Path...

IOTransfer V4 - Unquoted Service Path Vulnerability

Exploit Title: IOTransfer V4 - Unquoted Service Path Exploit Author: BLAY ABU SAFIAN Inveteck Global Vendor Homepage: http://www.iobit.com/en/index.php Software Link: https://iotransfer.itopvpn.com/download/ Tested Version: V4 Vulnerability Type: Unquoted Service Path Tested on OS: Microsoft...

IOTransfer V4 - Unquoted Service Path

Exploit Title: IOTransfer V4 - Unquoted Service Path Exploit Author: BLAY ABU SAFIAN Inveteck Global Discovery Date: 2022-28-07 Vendor Homepage: http://www.iobit.com/en/index.php Software Link: https://iotransfer.itopvpn.com/download/ Tested Version: V4 Vulnerability Type: Unquoted Service Path...

GHSA-455W-C45V-86RG fastify vulnerable to denial of service via malicious Content-Type

Impact An attacker can send an invalid Content-Type header that can cause the application to crash, leading to a possible Denial of Service attack. Only the v4.x line is affected. This was updated: upon a close inspection, v3.x is not affected after all. Patches Yes, update to v4.8.0. Workarounds...

CVE-2022-35150

Baijicms v4 was discovered to contain an arbitrary file upload vulnerability...

Privilege escalation

Baijicms v4 was discovered to contain an arbitrary file upload vulnerability...

CVE-2022-35150

Baijicms v4 contains an arbitrary file upload vulnerability due to lack of validation of uploaded files. Reported across multiple sources (CNVD/CNNVD/NI CVD records) with potential for remote code execution and high impact (based on CVSS 3.1 metrics: AV:N, AC:L, PR:N, UI:N, S:U, C:H, I:H, A:H). E...