5084 matches found
Path traversal
The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server...
CVE-2022-2638
CVE-2022-2638 affects the WordPress Export All URLs plugin prior to version 4.4. The vulnerability arises from insufficient validation of the path of the CSV file to be removed, enabling high-privilege users to delete arbitrary files on the server. Public sources in the connected documents consis...
CVE-2022-22897
A SQL injection vulnerability in the productalloneimg and imageproduct parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data...
PT-2022-17822 · WordPress · Export All Urls
Name of the Vulnerable Software and Affected Versions: Export All URLs WordPress plugin versions prior to 4.4 Description: The issue concerns a lack of validation for the file path to be removed on the system, which is supposed to be a CSV file. This could allow high privilege users to delete...
WordPress plugin Export All URLs 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
get-process-by-name 安全漏洞
get-process-by-name is a library by Justin Personal Developer. Get process letters using executable names. A security vulnerability exists in all versions of the get-process-by-name package that stems from its mishandling of the getProcessByName function leading to arbitrary code execution...
PT-2022-4637 · Measuresoft · Measuresoft Scadapro Server +1
Name of the Vulnerable Software and Affected Versions: Measuresoft ScadaPro Server and Client All Versions Description: The issue is related to the incorrect resolution of links before file access in the Measuresoft ScadaPro Server and Client. This could potentially allow a remote attacker to...
WordPress All-in-One WP Migration plugin <= 7.62 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability
Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Team ISH Tecnologia in WordPress All-in-One WP Migration plugin versions = 7.62. Solution Update the WordPress All-in-One WP Migration plugin to the latest available version at least 7.63...
All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS
The plugin uses the wrong content type for, and does not properly escape the response from the ai1wmexport action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. "...
PT-2022-4635 · Measuresoft · Measuresoft Scadapro Server
Name of the Vulnerable Software and Affected Versions: Measuresoft ScadaPro Server All Versions Description: The issue is related to a use-after-free condition when processing a specific project file, which can allow an attacker to execute arbitrary code remotely. This is associated with the...
The vulnerability of the `std::fs::remove_dir_all` function in the Rust programming language allows a malicious actor to delete any system files and directories they desire.
The vulnerability of the std::fs::removedirall function in the Rust programming language is related to synchronization errors when using a shared resource. Exploiting this vulnerability could allow an attacker to delete arbitrary system files and directories...
Intel Datacenter Group Event 代码问题漏洞
Intel Datacenter Group Event is a data center group event consulting software from Intel Corporation USA. A security vulnerability exists in all versions of the Intel Datacenter Group Event Android application. An attacker exploited the vulnerability to escalate privileges...
aalborgstift.dk Cross Site Scripting vulnerability OBB-2841857
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Emerson ControlWave 数据伪造问题漏洞
Emerson ControlWave is a highly programmable controller from Emerson Electric U.S. that combines the unique capabilities of a Programmable Logic Controller PLC and a Remote Terminal Unit RTU into a hybrid controller. A data forgery vulnerability exists in all versions of Emerson ControlWave, whic...
WordPress Export All URLs plugin <= 4.3 - Authenticated Arbitrary System File Removal vulnerability
Authenticated Arbitrary System File Removal vulnerability discovered by Raad Haddad in WordPress Export All URLs plugin versions = 4.3. Solution Update the WordPress Export All URLs plugin to the latest available version at least 4.4...
UBUNTU-CVE-2020-1754
In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups...
Kaspersky VPN Secure Connection 安全漏洞
Kaspersky VPN Secure Connection is a Vpn client software from the Russian company Kaspersky. The software checks the security of the network. If the Wi-Fi network is not secure, Kaspersky VPN Secure Connection prompts you to enable a secure connection by connecting to a specially assigned server...
GHSA-CQFC-9452-R36J curljs Command Injection vulnerability
A command injection vulnerability affects all versions of the package curljs...