CVE-2019-8933

CVE-2019-8933 affects DedeCMS 5.7SP2. An attacker can upload a PHP file to uploads/ and execute it by abusing the management/template workflow: navigate to Default Template Management, create a New Template, and alter the filename from ../index.html to ../index.php. This indicates a path/filename...

Arbitrary Code Execution

flac is vulnerable to arbitrary code execution. A stack-based buffer overflow in streamdecoder.c allows an attacker to pass a malicious FLAC audio file to execute arbitrary code or crash the process when the file is read...

Updated terminology package fixes security vulnerability CVE-2018-20167

Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command when \epn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME types...

CVE-2018-5199

In Veraport G3 ALL on MacOS, due to insufficient domain validation, It is possible to overwrite installation file to malicious file. A remote unauthenticated attacker may use this vulnerability to execute arbitrary file...

CVE-2018-5199 WIZVERA Remote Code Execution Vulnerability

In Veraport G3 ALL on MacOS, due to insufficient domain validation, It is possible to overwrite installation file to malicious file. A remote unauthenticated attacker may use this vulnerability to execute arbitrary file...

CVE-2018-5199

CVE-2018-5199 affects Veraport G3 ALL on macOS. The root cause is insufficient domain validation, enabling an attacker to overwrite an installation file with a malicious file and potentially execute arbitrary code. Exploitation details are not provided in the documents beyond the high-level descr...

Panasonic PC Registration Unreferenced Service Path Vulnerability

The Panasonic PC is a computer device from the Japanese company Panasonic. A security vulnerability exists in Panasonic PCs devices manufactured in October 2009 and later with Windows 7, Windows 8, Windows 8.1, and Windows 10 preinstalled. An attacker could exploit the vulnerability to execute...

GetSimple CMS HTML File Execution Vulnerability (CNVD-2019-00329)

Cagintranet GetSimple CMS is an XML-based content management system CMS from Cagintranet Networks, USA. The system includes a theme selector and editor, component editor, image and file managers, and more. A security vulnerability exists in Cagintranet GetSimple CMS version 3.3.15. An attacker ca...

GetSimple CMS HTML File Execution Vulnerability

Cagintranet GetSimple CMS is an XML-based content management system CMS from Cagintranet Networks, USA. The system includes a theme selector and editor, component editor, image and file managers, and more. A security vulnerability exists in Cagintranet GetSimple CMS version 3.3.15. An attacker ca...

VulnCheck KEV: CVE-2016-3088

The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request...

CVE-2018-0662

Multiple I-O DATA network camera products TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier allow an attacker on the same network segment to add malicious files on the device and execute arbitrary code...

Severe PHP Exploit Threatens WordPress Sites with Remote Code Execution

UPDATE Researchers have created a proof-of-concept exploit that would enable bad actors to target a severe vulnerability in the PHP programming language behind several major CMS companies, including WordPress. The vulnerability remains unresolved – more than a year after it was reported. The...

CVE-2018-14028

In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then...

CVE-2018-14028

In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then...

CVE-2018-14028

In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then...

PT-2018-1938 · Phpmyadmin +2 · Phpmyadmin +2

Name of the Vulnerable Software and Affected Versions: phpMyAdmin versions 4.8.0 through 4.8.1 Description: An issue was discovered in phpMyAdmin where an attacker can include and potentially execute files on the server due to improper testing for whitelisted pages during page redirection and...

CVE-2018-12356

An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extension script...

WordPress Redirection Plugin PHP File Execution Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. WordPress Redirection Plugin PHP File Execution Vulnerability ACE File Inclusion Vulnerability allows administrators to execu...

CVE-2017-7766

An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation through the Mozilla Maintenance Service to allow for arbitrary file execution and deletion by the Maintenance Service, which has privileged access. Note: This attack requires loca...

CVE-2017-7766

An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation through the Mozilla Maintenance Service to allow for arbitrary file execution and deletion by the Maintenance Service, which has privileged access. Note: This attack requires loca...