CVE-2025-11170

CVE-2025-11170 WP移行専用プラグイン for CPI = 1.0.2 - 認証なし任意ファイルアップロード 🚀 WP移行専用プラグイン for CPI = 1.0.2 - 認証なし任意ファイルアップロード 📝 説明 WordPress用プラグイン WP移行専用プラグイン for CPI は、CpiwmImportController::import 関数におけるファイルタイプ検証の欠如により、1.0.2 を含む全バージョンで任意ファイルアップロードの脆弱性があります。 これにより、認証されていない攻撃者が影響を受けるサイトのサーバーに任意のファイルをアップロード...

CVE-2026-41012

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

CVE-2026-41012 BOSH vSphere CPI Improper Cert Validation

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

EUVD-2026-68038

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

CVE-2026-41012 BOSH vSphere CPI Improper Cert Validation

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

CVE-2026-41012

CVE-2026-41012 is a traffic interception vulnerability in BOSH Director vSphere CPI (all versions prior to v98.0.6 ) caused by insufficient certificate validation and pinning in the communication between BOSH Director and vCenter. An attacker positioned between the two can impersonate the vCenter...

PT-2026-83390

Name of the Vulnerable Software and Affected Versions BOSH vSphere CPI versions prior to 98.0.6 Description An issue in the communication protocol between BOSH Director and vCenter allows an attacker positioned between these two entities to intercept traffic and impersonate the vCenter REST API...

CVE-2026-41012: Improper Certificate Validation

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

CVE-2026-41012- BOSH VSphere CPI Improper Cert Validation | Cloud Foundry

Severity HIGH CVSSv4: High 8.8 CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSSv3: High 7.7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Vendor Cloud Foundry Foundation Versions Affected Severity is HIGH unless otherwise noted. BOSH VSphere CPI All versions prior to v98.0.6...

SUSE CVE-2026-47828

During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network...

CVE-2026-47828

During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network...

CVE-2026-47828

During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network...

CVE-2026-45137

Anchor is a framework providing several convenient developer tools for writing Solana programs. From 1.0.0 to before 1.0.2, an logic error causes anchor programs to accept any program id when requiring the system program id, causing false assumptions resulting in potential arbitrary cpi in progra...

CVE-2026-45137

Anchor is a framework providing several convenient developer tools for writing Solana programs. From 1.0.0 to before 1.0.2, an logic error causes anchor programs to accept any program id when requiring the system program id, causing false assumptions resulting in potential arbitrary cpi in progra...

CVE-2026-45137 Anchor: Program<'info, System> is not properly validated

Anchor is a framework providing several convenient developer tools for writing Solana programs. From 1.0.0 to before 1.0.2, an logic error causes anchor programs to accept any program id when requiring the system program id, causing false assumptions resulting in potential arbitrary cpi in progra...

CVE-2026-45137: Improper Input Validation

Anchor is a framework providing several convenient developer tools for writing Solana programs. From 1.0.0 to before 1.0.2, an logic error causes anchor programs to accept any program id when requiring the system program id, causing false assumptions resulting in potential arbitrary cpi in progra...

CVE-2025-11170

The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the CpiwmImportController::import function in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

EUVD-2025-60945

The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the CpiwmImportController::import function in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

CVE-2025-11170

CVE-2025-11170 concerns the WP移行専用プラグイン for CPI (WordPress) up to version 1.0.2, where missing file type validation in Cpiwm_Import_Controller::import allows unauthenticated uploads of arbitrary files. The consequence stated across sources is potential remote code execution on the affected site, ...

CVE-2025-11170: Unrestricted Upload of File with Dangerous Type

The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the CpiwmImportController::import function in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the...