WordPress plugin Sirv security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce Webhooks lies in their inability to prevent unlimited uploading of dangerous files, allowing attackers to execute arbitrary code.

The vulnerability of programming platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce Webhooks is related to the unlimited uploading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

Simple Online Hotel Reservation System Code Issue Vulnerability

Simple Online Hotel Reservation System is an online hotel reservation system. A code issue exists in version 1.0 of the Simple Online Hotel Reservation System where an incorrect manipulation of the parameter photo can result in unrestricted file uploads...

The vulnerability of the UpLoadServlet component in the ProSAFE Network Management System (NMS300) allows a perpetrator to execute arbitrary code.

The vulnerability of the UpLoadServlet component in the ProSAFE Network Management System NMS300 involves unlimited uploading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-6000

The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'displayticketthemespage' function in versions up to, and including, 1.19.20. This makes it possible for authenticated attackers with...

CVE-2024-2024

The Folders Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handlefoldersfileupload' function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author access and above, to upload...

CVE-2024-2024

CVE-2024-2024 affects Folders Pro for WordPress. All versions up to 3.0.2 fail to validate file types in handle_folders_file_upload, allowing authenticated users with author+ privileges to upload arbitrary files to the server, with potential remote code execution. Remediation: upgrade to 3.0.3 (p...

Verint Workforce Optimization Code Issue Vulnerability

Verint Systems Verint Workforce Optimization WFO is an employee performance management solution from Verint Systems, USA. The product supports workforce management, call recording, automated quality management, performance management, text and desktop analytics, and more. A code issue vulnerabili...

CVE-2024-37038

CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests...

CVE-2024-37038

CVE-2024-37038 affects Schneider Electric Sage RTU devices. The root cause is CWE-276: Incorrect Default Permissions, enabling an authenticated user with access to the device web interface to perform unauthorized file and firmware uploads by crafting crafted web requests. Impact stated across sou...

Schneider Electric SAGE RTUs Security Vulnerability

Schneider Electric SAGE RTUs is a high-performance device for industrial automation and remote monitoring from Schneider Electric France. A security vulnerability exists in the Schneider Electric SAGE RTUs that stems from the presence of incorrect default permissions that allow authenticated user...

PT-2024-18206 · Megabip · Megabip

Name of the Vulnerable Software and Affected Versions: MegaBIP software versions through 5.10 Description: The issue allows an attacker to upload any file to the server, including a PHP code file, without authentication. This enables potential execution of malicious code on the server...

The vulnerability of the IT service management web component Ivanti Neurons for ITSM allows a attacker to write files to arbitrary directories on the ITSM server.

The vulnerability of the IT service management web component Ivanti Neurons for ITSM is related to the unlimited uploading of dangerous files. Exploiting this vulnerability allows a malicious actor to write files to any directory on the ITSM server...

CVE-2024-4620

CVE-2024-4620 concerns ARForms – Premium WordPress Form Builder Plugin. The vulnerability affects versions prior to 6.6 and allows unauthenticated users to modify uploaded files in a form so that PHP code can be uploaded, enabling remote code execution on affected WordPress servers. The CVSS v3.1...

CVE-2024-2624

A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the @router.get"/switchpersonalpath" endpoint in ./lollms-webui/lollmscore/lollms/server/endpoints/lollmsuser.py. The vulnerability arises due to insufficient sanitization...

CVE-2024-2624 Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webui

A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the @router.get"/switchpersonalpath" endpoint in ./lollms-webui/lollmscore/lollms/server/endpoints/lollmsuser.py. The vulnerability arises due to insufficient sanitization...

CVE-2024-2624

The connected Red Hat, NVD, OSV, and CVE records confirm a path traversal and arbitrary file upload vulnerability in parisneo/lollms-webui, affecting versions prior to 9.4 and exploitable via the /switch_personal_path endpoint in lollms_user.py. Root cause: insufficient sanitization of the path p...

Devellion CubeCart Security Breach

Devellion CubeCart is a free and open source e-commerce shopping cart software from the company of Devellion UK. The software supports selling products, adding/editing products or images in an online store, etc. A security vulnerability exists in Devellion CubeCart v.6.5.5 and earlier versions,...

Broken Access Control

typo3/cms-core is vulnerable to Broken Access Control. The vulnerability is due to improper restriction of import functionality, which normally is limited to admin users or those with explicit user TSconfig settings. The vulnerability enables file uploads bypassing file abstraction layer...

PT-2024-27437 · Jan · Jan

Name of the Vulnerable Software and Affected Versions: Jan version 0.4.12 Description: The issue allows attackers to execute arbitrary code via uploading a crafted file to the "/v1/app/appendFileSync" interface. Recommendations: For Jan version 0.4.12, as a temporary workaround, consider disablin...