PT-2024-26433 · Libyaml · Libyaml

Name of the Vulnerable Software and Affected Versions: libyaml versions up to 0.2.5 Description: A vulnerability was found in libyaml, affecting the function yaml event delete of the file /src/libyaml/src/api.c. The manipulation leads to a double-free. Recommendations: For libyaml versions up to...

PT-2024-18425 · Sourcecodester · Simple Student Attendance System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Student Attendance System version 1.0 Description: A critical issue was found in the function delete class/delete student of the file /ajax-api.php of the component List of Classes Page. The manipulation of the argument ...

PT-2024-1293

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 6.7.1 Description The issue is related to a use-after-free in the cec queue msg fh function, which is associated with the files cec-adap.c and cec-api.c in the drivers/media/cec/core directory. This problem is als...

PT-2023-27178 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel versions 1.4.3 Description: An arbitrary file write vulnerability could lead to direct control of the server. In the api/v1/file.go file, there is a function called SaveContentthat,It that receives JSON data sent by users in the form o...

PT-2023-16986 · Meizhou Qingyunke · Qykcms

Name of the Vulnerable Software and Affected Versions: Meizhou Qingyunke QYKCMS version 4.3.0 Description: A vulnerability was found in the Update Handler component of Meizhou Qingyunke QYKCMS, affecting an unknown part of the file /admin system/api.php. The manipulation of the downurl argument...

CVE-2022-3939 lanyulei ferry API file.go path traversal

A vulnerability, which was classified as critical, has been found in lanyulei ferry. Affected by this issue is some unknown functionality of the file apis/public/file.go of the component API. The manipulation of the argument file leads to path traversal. The attack may be launched remotely...

Out-of-bounds

A vulnerability was found in jeecg-boot. It has been declared as critical. This vulnerability affects unknown code of the file /api/. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be...

GHSA-6CWV-WJ7V-73XP Magento executes code via the API File Option Upload Extension

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code...

PT-2022-16287

Name of the Vulnerable Software and Affected Versions Sidekiq versions prior to 5.2.10 Sidekiq versions prior to 6.4.0 Description The issue arises from the lack of a limit on the number of days when requesting stats for the graph in api.rb in Sidekiq. This leads to an overload of the system,...

CVE-2021-36042

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code...

CVE-2021-36042 Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code...

Dell EMC PowerScale OneFS elevation of privilege vulnerability (CNVD-2021-13938)

Dell EMC PowerScale OneFS is an API-powered file system. An elevation of privilege vulnerability exists in Dell EMC PowerScale OneFS 8.1.0 - 9.1.0. An attacker with the ISIPRIVJOBENGINE privilege could exploit this vulnerability by using a PermissionRepair job to grant themselves the highest leve...

PhpOK SQL Injection Vulnerability

phpok is a set of enterprise website system developed by Shenzhen锟絪 technology limited company using PHP+MYSQL language. PhpOK 5.4.137 suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability by injecting attachment data via SQL and then calling the attachment...

WordPress wp-google-maps plugin input validation error vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-google-maps plugin is a Google Maps plugin used in it. An input validation error vulnerability exists in the...

PHPAPP网站应用系统SQL注入1

简要描述： PHPAPP 全球领先的网站应用系统。 PHPAPP 全球网站应用的开创者,独创系统核心长期提供丰富网站应用程序,专为站长企业打造盈利应用。 详细说明： 第一个漏洞： PHPAPP网站应用系统官方最新版SQL注入 程序官网：http://www.phpapp.cn/index.html 在文件/api/chinabank/receive.php中： SetPayMoney$void,$vamount,'ChinaBank'; else $pay-PayError; else $pay-PayError; ? 从上面看出：...

phpcms v9 latest burst pipe processing password vulnerability-vulnerability warning-the black bar safety net

Vulnerability causes is not to say, 文件在phpcms/api.php interested basin friends can go dig a dig phpcms the 洞子 it. The main use of the process: The first step: to register a user http://www.wooyun.in/index.php?m=member&c=index&a=register&siteid=1 Second step: access the api file, broke the table...

ECShop 2.7.2 API 盲注漏洞

简要描述： 该漏洞已经过本人测试存在。在服务器关闭魔法引号的情况下可以盲注，不受ECShop内核过滤影响。这次不坑爹了 问题文件在/api/client/api.php 利用方法为POST 详细说明： /api/client/api.php 第7行 dispatch$POST; /api/client/includes/libapi.php 6 -10 行 $funcarr = array'GetDomain', 'UserLogin', 'AddCategory', 'AddBrand', 'AddGoods', 'GetCategory', 'GetBrand', 'GetGoods...

Fedora 10 : drupal-6.14-1.fc10 (2009-9751)

Fixes SA-CORE-2009-008 http://drupal.org/node/579482 Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script. Multiple vulnerabilities and weaknesses were discovered in Drupal...