362 matches found
OpenMage Magento Lts Code Execution Vulnerability
OpenMage Magento Lts Magento is an e-commerce system organized by OpenMage. A security vulnerability in OpenMage Magento Lts before versions 19.4.10 and 20.0.5 can be exploited by an attacker to remotely execute code, which can be injected into the server by an administrator with the privilege to...
CVE-2020-26295
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 an...
CVE-2020-26295
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 an...
CVE-2020-26285: Improper Limitation of a Pathname to a Restricted Directory
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an...
WordPress 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. Cross-site scripting vulnerability in WordPress SabaiApps DirectoriesPro plugin 1.3.45 and earlier...
Intland Software codeBeamer ALM Code Issue Vulnerability
Intland Software codeBeamer ALM is an application lifecycle management platform from Intland Software, Germany. The platform supports application lifecycle management, requirements management, risk management and software development. A security vulnerability exists in Intland codeBeamer ALM...
CVE-2020-1182
A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations on-premises version 10.0.11. An attacker who successfully exploited this vulnerability could gain remote code execution via server-side script execution on the victim server. An authenticated attacke...
Design/Logic Flaw
Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an external URL under attacker control, it's possible to send requests to external resources aka SSRF or leak files from the local system using the...
[SECURITY] Fedora 30 Update: phpMyAdmin-4.9.5-1.fc30
phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...
[SECURITY] Fedora 31 Update: php-horde-Horde-Data-2.1.5-1.fc31
A data import and export API, with backends for: CSV TSV iCalendar vCard vNote vTodo...
Fedora: Security Advisory for php-horde-Horde-Data (FEDORA-2020-0248ad925e)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Horde CSV import arbitrary PHP code execution
The HordeData module version 2.1.4 and before present in Horde Groupware version 5.2.22 allows authenticated users to inject arbitrary PHP code thus achieving RCE on the server hosting the web application. Module Options msf use exploit/multi/http/horde/csvrce msf undefinedcsvrce show actions...
Jama Connect Cross-Site Scripting Vulnerability
Jama Connect is an application lifecycle management product that can be deployed in the cloud or installed on Mac and Windows devices. A cross-site scripting vulnerability exists in Jama Connect 8.44.0. The vulnerability can be exploited to conduct a cross-site scripting attack via the Select...
VulnCheck KEV: CVE-2019-0193
The optional Apache Solr module DataImportHandler contains a code injection vulnerability...
The first Zbrunk dashboard and other news
The long New Year holiday season in Russia was not in vain. I had time to work on Zbrunk. As you can see, I made my first dashboard and added other features. No more timestamps in code I added functions to get Unix timestamps from lines in human-readable time format, e.g. "2019.12.10 13:00:00"...
The vulnerability of the DataImportHandler module of the Apache Solr search server allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the DataImportHandler module of the Apache Solr search server lies in its error handling for the “dataConfig” request. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...
[SECURITY] Fedora 30 Update: phpMyAdmin-4.9.2-1.fc30
phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...
[SECURITY] Fedora 31 Update: phpMyAdmin-4.9.2-1.fc31
phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...
CVE-2019-9745
CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This tool communicates with a service Recognition Update Client Service via an insecure communication channel Named Pipe. The data JSON sent via this channel is used to import data from...