CVE-2023-38704

import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. Prior to version 1.4.2, it allows for...

CVE-2023-30564

Alaris Systems Manager does not perform input validation during the Device Import Function...

Input validation

Alaris Systems Manager does not perform input validation during the Device Import Function...

Session fixation

A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session...

CVE-2023-30563

BD Alaris Systems Manager (SM) versions 12.3 and prior are affected by CVE-2023-30563, an improper input validation vulnerability that allows a malicious file uploaded via the System Manager User Import Function to trigger a Cross-Site Scripting (XSS) condition and hijack a user session. The CVSS...

BD Alaris System with Guardrails Suite MX 跨站脚本漏洞

The BD Alaris System with Guardrails Suite MX is a medical device from Biddy Medical BD, Inc. A security vulnerability exists in the BD Alaris System with Guardrails Suite MX that stems from Alaris Systems Manager not performing input validation during the device import function...

WordPress Plugin Better Search 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

Incorrect Authorization to Stored XSS in Import User Role function

Description The application incorrectly checks user permissions, enabling the attacker to use the 'import file user roles' functionality, which contains a payload for executing JavaScript code, without requiring any specific privileges. Proof of Concept Step1: Even without the privilege to manage...

WordPress Plugin WooCommerce Dynamic Pricing and Discounts 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-24405 · Axtls · Axtls

Name of the Vulnerable Software and Affected Versions: axTLS version 2.1.5 Description: A heap buffer overflow was discovered in the bi import function, located in axtls-code/crypto/bigint.c, which allows attackers to cause a Denial of Service DoS when parsing a private key. Recommendations: For...

PT-2023-16820 · WordPress · Http Headers

Name of the Vulnerable Software and Affected Versions: HTTP Headers WordPress plugin versions prior to 1.18.8 Description: The issue concerns an import functionality in the HTTP Headers WordPress plugin that executes arbitrary SQL on the server, leading to an SQL Injection vulnerability. This...

SUSE CVE-2020-28599

A stack-based buffer overflow vulnerability exists in the importstl.cc:importstl functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...

SUSE CVE-2022-0496

A vulnerbiility was found in Openscad, where a DXF-format drawing with particular not necessarily malformed! properties may cause an out-of-bounds memory access when imported using import...

CVE-2023-24028

In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function...

CVE-2023-24028

In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function...

CVE-2023-24028

In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function...

PT-2023-19369 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.167 Description: The issue concerns incorrect access control in the ACLComponent.php file for the decaying import function. This affects the app/Controller/Component/ACLComponent.php component. Recommendations: For MISP versi...

Local File Read through Improper Filename Validation

Description This vulnerability occur because there is no filename validation on logoimagelogin and logoimageheader on import and export function. Attacker can use path traversal payload to leak local file such as /etc/passwd or froxlor config file. Proof of Concept 1. Go to import function on...

CVE-2022-45025

Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function...

Markdown Preview Enhanced 操作系统命令注入漏洞

Markdown Preview Enhanced is a super-powerful markdown extension by the individual developer Yiyi Wang. An operating system command injection vulnerability exists in Markdown Preview Enhanced version v0.6.5 and v0.19.6. An attacker can exploit this vulnerability to perform command injection via t...