2525 matches found
CVE-2022-37346
The CVE-2022-37346 issue affects the EC-CUBE plugin “Product Image Bulk Upload Plugin” versions 1.0.0 and 4.1.0, which has an insufficient verification (CWE-20) when uploading files. An unauthenticated remote attacker can upload arbitrary non-image files, and if a user with administrative privile...
PT-2022-23939 · Ec Cube · Product Image Bulk Upload Plugin +1
Name of the Vulnerable Software and Affected Versions: EC-CUBE plugin 'Product Image Bulk Upload Plugin' versions 1.0.0 through 4.1.0 Description: The issue is related to an insufficient verification vulnerability when uploading files. This allows a remote unauthenticated attacker to upload...
Exploit for Path Traversal in Apache Http_Server
Apache 2.4.50 - Path Traversal or Remote Code Execution cve-20...
EC-CUBE 代码问题漏洞
EC-CUBE is an open source e-commerce system from EC-CUBE Japan. A security vulnerability exists in EC-CUBE Plugin Product Image Bulk Upload Plugin 1.0.1 and earlier versions, which stems from insufficient authentication when uploading files and can be exploited by remote attackers to upload...
GitLab: RepositoryPipeline allows importing of local git repos
Summary When importing a project via the BulkImports, the response field httpUrlToRepo from the client is used to fetch the repo: https://gitlab.com/gitlab-org/gitlab/-/blob/v15.3.1-ee/lib/bulkimports/projects/pipelines/repositorypipeline.rbL17 ruby def loadcontext, data url = data'httpUrlToRepo'...
CVE-2022-26309
Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation User operation resulting in elevation of privilege to Administrator group...
Cross site request forgery (csrf)
Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation User operation resulting in elevation of privilege to Administrator group...
CVE-2022-26309 Cross-Site Request en Bulk operation (User operation)
Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation User operation resulting in elevation of privilege to Administrator group...
CVE-2022-33169
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Force ID: 228888...
CVE-2022-33169
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Force ID: 228888...
Design/Logic Flaw
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Force ID: 228888...
PT-2022-17777 · Unknown · Pandora Fms
Name of the Vulnerable Software and Affected Versions: Pandora FMS version 7.0NG.759 Description: The issue allows Cross-Site Request Forgery in Bulk operation, specifically in the User operation, resulting in elevation of privilege to the Administrator group. Recommendations: For Pandora FMS...
IBM Robotic Process Automation 安全漏洞
IBM Robotic Process Automation is a robotic process automation product from IBM USA. It helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. A security vulnerability exists in IBM Robotic Process Automation versions 21.0.0, 21.0.1, and 21.0.2 that...
Artica Pandora FMS 跨站请求伪造漏洞
Artica Pandora FMS is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. Artica Pandora FMS suffers from a cross-site request forgery vulnerability that originates in Pandora FMS v7.0NG.759 that...
CVE-2022-33169
IBM Robotic Process Automation (RPA) versions 21.0.0–21.0.2 are vulnerable to insufficiently protected credentials for users created via bulk upload. The IBM Security Bulletin (and associated CVE-2022-33169 records) confirm affected products and affected versions: IBM RPA < 21.0.3, IBM RPA for...
CVE-2022-33169
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Force ID: 228888...
Improper Input Validation
Description Input validation is a frequently-used technique for checking potentially dangerous inputs in order to ensure that the inputs are safe for processing within the code, or when communicating with other components. When software does not validate input properly, an attacker is able to cra...
Newsletter SQL注入漏洞
Newsletter is a one-click bulk email solution. A security vulnerability exists in the Newsletter v3.x series of releases that stems from a security issue with the zemeznewsletteremail parameter...
Malicious code in sa-383-bulk-creative-update (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2cc6c432bfe7d8dd378007ac5eaa6114103d9d5708ce6d92ac2ea88cb6eb8640 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...