CVE-2022-23766 BigFileAgent arbitrary file execution vulnerability

An improper input validation vulnerability leading to arbitrary file execution was discovered in BigFileAgent. In order to cause arbitrary files to be executed, the attacker makes the victim access a web page d by them or inserts a script using XSS into a general website...

CVE-2022-23766

Mode C: CVE-2022-23766 affects BigFileAgent and is described as an improper input validation vulnerability that enables arbitrary file execution when a user visits a malicious page or an attacker injects XSS into a page. The connected records corroborate the general description and note BigFileAg...

CVE-2022-23766 BigFileAgent arbitrary file execution vulnerability

An improper input validation vulnerability leading to arbitrary file execution was discovered in BigFileAgent. In order to cause arbitrary files to be executed, the attacker makes the victim access a web page d by them or inserts a script using XSS into a general website...

BigFile BigFileAgent 输入验证错误漏洞

BigFileAgent is a famous download site in Korea by BigFile Inc. It is used to provide download resources such as movies, TV, games, software and so on. An input validation error vulnerability exists in BigFileAgent versions prior to 1.0.1.9, which stems from the presence of an incorrect input...

PT-2022-16253 · Unknown · Bigfileagent

Name of the Vulnerable Software and Affected Versions: BigFileAgent affected versions not specified Description: An improper input validation issue allows for arbitrary file execution in BigFileAgent. Attackers can exploit this by having victims access a malicious web page or by inserting a scrip...

CVE-2022-38323

Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /RoyalEvent/updateimage.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-36121

Blue Prism Enterprise 6.0–7.01 is affected by a vulnerability that exists when the Blue Prism Application server is misconfigured, allowing an authenticated user to reverse engineer the software and bypass access controls on the UpdateOfflineHelpData function. This enables changing the offline he...

Design/Logic Flaw

An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed...

CVE-2022-2634

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...

The vulnerability of the Fileserver application of the Apache ActiveMQ software platform, which allows a hacker to download and execute any file they desire.

The vulnerability of the Fileserver application of the Apache ActiveMQ software platform exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to upload and execute any file using the HTTP PUT method, followed by an HTTP MOVE request...

SUSE SLES15 Security Update : rubygem-tzinfo (SUSE-SU-2022:2592-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:2592-1 advisory. - TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to...

Design/Logic Flaw

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.0 49183. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Vulnerability fixed in RealVNC VNC Server

RealVNC has fixed a vulnerability in VNC Server for Windows. A local, authenticated malicious party can exploit the exploit the vulnerability to obtain elevated privileges on the system on which VNC Server is installed. The vulnerability is caused by an installation file executing files in %TEMP%...

Input validation

Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable function...

Handysoft Groupware 输入验证错误漏洞

Handysoft Handy Groupware is an office collaboration solution from Handysoft Korea. The product supports features such as meeting management, attendance management, and human resource assessment. A security vulnerability exists in Handysoft Groupware for Windows, which originates from incorrect...

GHSA-CGRV-6H2H-6F7V MODX Revolution Directory Traversal Vulnerability

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

EulerOS Virtualization 2.10.1 : babel (EulerOS-SA-2022-1367)

According to the versions of the babel package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files containing serialized Python objects via...

CVE-2022-20739 Cisco SD-WAN vManage Software Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as the root user. The attacker must be authenticated on the affected system as a low-privileged user to exploit this...

CVE-2022-20739

A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as the root user. The attacker must be authenticated on the affected system as a low-privileged user to exploit this...

Design/Logic Flaw

Zoo Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /publichtml/applyvacancy. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...