CVE-2020-36842

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvividuploadimportfiles and wpvividuploadfiles AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently...

CVE-2020-36842

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvividuploadimportfiles and wpvividuploadfiles AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently...

CVE-2020-36842

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads in versions up to and including 0.9.35 . The root cause is a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions, which allows low-level authenticate...

Astaroth Banking Malware Resurfaces in Brazil via Spear-Phishing Attack

A new spear-phishing campaign targeting Brazil has been found delivering a banking malware called Astaroth aka Guildma by making use of obfuscated JavaScript to slip past security guardrails. "The spear-phishing campaign's impact has targeted various industries, with manufacturing companies, reta...

CVE-2020-36842: Unrestricted Upload of File with Dangerous Type

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvividuploadimportfiles and wpvividuploadfiles AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently...

server crash by zip bomb

This report is not public...

[SECURITY] Fedora 41 Update: libgsf-1.14.53-1.fc41

A library for reading and writing structured files e.g. MS OLE and Zip...

USN-7015-4: Python vulnerability

USN-7015-1 fixed several vulnerabilities in Python. This update provides the corresponding update for CVE-2023-27043 for python2.7 and python3.5 in Ubuntu 14.04 LTS. Original advisory details: It was discovered that the Python email module incorrectly parsed email addresses that contain special...

[SECURITY] Fedora 40 Update: libgsf-1.14.53-1.fc40

A library for reading and writing structured files e.g. MS OLE and Zip...

[SECURITY] Fedora 39 Update: libgsf-1.14.53-1.fc39

A library for reading and writing structured files e.g. MS OLE and Zip...

Debian dla-3915 : fonts-opensymbol - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3915 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3915-1 [email protected] https://www.debian.org/lts/security/...

CVE-2024-9232 Download Plugins and Themes in ZIP from Dashboard <= 1.9.1 - Reflected Cross-Site Scripting

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to...

CVE-2024-9232: Improper Neutralization of Input During Web Page Generation

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to...

WordPress plugin Download Plugins and Themes in ZIP from Dashboard 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

Extract 安全漏洞

Extract is a Go library open-sourced by codeclysm. It is used to extract archives in zip, tar.gz or tar.bz2 format. A security vulnerability exists in Extract versions prior to 4.0.0, which stems from a maliciously constructed archive file that allows an attacker to create symbolic links outside ...

PT-2024-39508

Name of the Vulnerable Software and Affected Versions Download Plugins and Themes in ZIP from Dashboard plugin for WordPress versions up to, and including, 1.9.1 Description The issue arises from the use of add query arg without proper escaping on the URL, leading to Reflected Cross-Site Scriptin...

Directory Traversal

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Directory Traversal within the isinorequal function. An attacker can access restricted files by manipulating file paths using parent directory...

[SECURITY] Fedora 41 Update: p7zip-16.02-31.fc41

p7zip is a port of 7za.exe for Unix. 7-Zip is a file archiver with a very high compression ratio. The original version can be found at http://www.7-zip.org/...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2024-2504)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP12 : golang (EulerOS-SA-2024-2504)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment...