Seller can steal ETH which is for other orders of the bulk

Lines of code Vulnerability details Impact The 'bulkExecute' and 'returnDust' functions are susceptible to reentrancy attack. Seller can exploit it to steal ETH which is for other orders of the bulk. Proof of Concept Key steps for successful attack 1 set fee rate to 100% 2 reentrancy call...

ALPINE-CVE-2022-42313

Xenstore: guests can let run xenstored out of memory This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service...

CVE-2022-37346

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative...

Design/Logic Flaw

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative...

CVE-2022-37346

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative...

CVE-2022-37346

The CVE-2022-37346 issue affects the EC-CUBE plugin “Product Image Bulk Upload Plugin” versions 1.0.0 and 4.1.0, which has an insufficient verification (CWE-20) when uploading files. An unauthenticated remote attacker can upload arbitrary non-image files, and if a user with administrative privile...

PT-2022-23939 · Ec Cube · Product Image Bulk Upload Plugin +1

Name of the Vulnerable Software and Affected Versions: EC-CUBE plugin 'Product Image Bulk Upload Plugin' versions 1.0.0 through 4.1.0 Description: The issue is related to an insufficient verification vulnerability when uploading files. This allows a remote unauthenticated attacker to upload...

CVE-2022-37346: Unrestricted Upload of File with Dangerous Type

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative...

Exploit for Path Traversal in Apache Http_Server

Apache 2.4.50 - Path Traversal or Remote Code Execution cve-20...

EC-CUBE 代码问题漏洞

EC-CUBE is an open source e-commerce system from EC-CUBE Japan. A security vulnerability exists in EC-CUBE Plugin Product Image Bulk Upload Plugin 1.0.1 and earlier versions, which stems from insufficient authentication when uploading files and can be exploited by remote attackers to upload...

GitLab: RepositoryPipeline allows importing of local git repos

Summary When importing a project via the BulkImports, the response field httpUrlToRepo from the client is used to fetch the repo: https://gitlab.com/gitlab-org/gitlab/-/blob/v15.3.1-ee/lib/bulkimports/projects/pipelines/repositorypipeline.rbL17 ruby def loadcontext, data url = data'httpUrlToRepo'...

CVE-2022-26309

Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation User operation resulting in elevation of privilege to Administrator group...

Cross site request forgery (csrf)

Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation User operation resulting in elevation of privilege to Administrator group...

CVE-2022-26309 Cross-Site Request en Bulk operation (User operation)

Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation User operation resulting in elevation of privilege to Administrator group...

CVE-2022-26309

Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation User operation resulting in elevation of privilege to Administrator group...

CVE-2022-33169

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Force ID: 228888...

CVE-2022-33169

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Force ID: 228888...

Design/Logic Flaw

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Force ID: 228888...

PT-2022-17777 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS version 7.0NG.759 Description: The issue allows Cross-Site Request Forgery in Bulk operation, specifically in the User operation, resulting in elevation of privilege to the Administrator group. Recommendations: For Pandora FMS...

Artica Pandora FMS 跨站请求伪造漏洞

Artica Pandora FMS is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. Artica Pandora FMS suffers from a cross-site request forgery vulnerability that originates in Pandora FMS v7.0NG.759 that...