Deserialization of untrusted data

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via deserialization of untrusted input from the 'gopricing' shortcode 'data' parameter. This allows authenticated attackers, with subscriber-lev...

Vulnerability fixed in GitLab Enterprise Edition and Community Edition

GitLab has fixed a vulnerability in GitLab 16.0.0. A unauthenticated remote malicious person could exploit to gain access to arbitrary files on the server via a path traversal. The vulnerability is exploitable when the malicious party has knowledge has knowledge of an attachment in a public proje...

D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability

This vulnerability allows remote attackers to create and delete arbitrary files on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The specific flaw exists within the uploadMib function. The issue results from the lack of proper validation of a...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to delete arbitrary files.

The vulnerability in the web interface for managing Cisco Identity Services Engine ISE platforms relates to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to delete arbitrary files using a specially created HTTP request...

Upload Resume <= 1.2.0 - Captcha Bypass

The plugin does not validate the captcha parameter when uploading a resume via the resumeuploadform shortcode, allowing unauthenticated visitors to upload arbitrary media files to the site. PoC The PoC will be displayed once the issue has been remediated...

Path Traversal

pimcore/pimcore is vulnerable to Path Traversal. The vulnerability exists due to a lack of validation in the CustomReportController.php file, which allows an attacker to access files outside the expected directory and download arbitrary files...

Path Traversal

mlflow is vulnerable to Path Traversal. The vulnerability exists because the library does not properly validate the source URLs, allowing an attacker to access files outside the expected directory and read arbitrary files through the relative path such as \..\filename...

CVE-2023-25953

Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the affected product is installed to inject arbitrary code while processing the product execution. Since a full disk access privilege is required to execute LIN...

CVE-2023-25953

Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the affected product is installed to inject arbitrary code while processing the product execution. Since a full disk access privilege is required to execute LIN...

WordPress plugin Go Pricing - WordPress Responsive Pricing Tables 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Go Pricing - WordPres...

GitLab < 16.0.1 (CVE-2023-2825)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an...

MicroEngine Mailform 路径遍历漏洞

MicroEngine Mailform is a PHP mail form from MicroEngine Japan. A security vulnerability exists in MicroEngine Mailform versions 1.1.0 through 1.1.8, which stems from a path traversal vulnerability that could allow a remote attacker to save an arbitrary file on the server and execute it...

CVE-2023-27066

Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle...

Directory traversal

Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle...

Path Traversal

pimcore/pimcore is vulnerable to Path Traversal. The vulnerability exists due to a lack of validation in the scriptPath parameter, which allows an attacker to access files outside the expected directory and download arbitrary files...

CVE-2023-27066

Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle...

CVE-2023-27066

Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle...

CVE-2023-27067

Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a malicious actor to read arbitrary files.

The vulnerability of the Cisco Identity Services Engine ISE’s web management interface is related to deficiencies in path name checking for access-limited directories. Exploiting this vulnerability could allow a malicious actor, operating remotely, to read arbitrary files using a specially create...

Cisco Identity Services Engine XML External Entity Injection Vulnerability

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. An XML external entity injection vulnerability...