142 matches found
PRODSECBUG-2223: Remote code execution when using functionality that imports a new product
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
ImageCache Actions - Critical - Multiple Vulnerabilities - SA-CONTRIB-2019-056
The imagecache actions module defines a number of additional image effects that can be used to create image styles. The "Image styles admin" sub module provides additional functionality to duplicate, export and import image styles. The module uses unserialize to import image styles into another...
Bitbucket Data Center - Path traversal in the migration tool leads to RCE - CVE-2019-3397
h3. Issue Summary Bitbucket Data Center had a path traversal vulnerability in the Data Center migration tool. A remote attacker with authenticated user with admin permissions can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code executio...
Authentication flaw
SAP SRM MDM Catalog versions 3.73, 7.31, 7.32 in SAP NetWeaver 7.3 - import functionality does not perform authentication checks for valid repository user. This is an unauthenticated functionality that you can use on windows machines to do SMB relaying...
CVE-2017-13706
XML external entity XXE vulnerability in the import package functionality of the deployment module in Lansweeper before 6.0.100.67 allows remote authenticated users to obtain sensitive information, cause a denial of service, conduct server-side request forgery SSRF attacks, conduct internal port...
CVE-2015-6664: Undefined Security Weakness
XML external entity XXE vulnerability in the application import functionality in SAP Mobile Platform 2.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2152227...
White Label CMS <= 1.5.2 - Stored XSS
Due to a lack of CSRF protection, and lack of sanitation of user input, it is possible to trigger a Persistent XSS attack via a CSRF attack. This attack targets in particular the Import functionality, which is located in the 'wlcmsImport' function, within the file...
CVE-2014-9042: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the import functionality in the bookmarks application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote authenticated users to inject arbitrary web script or HTML by importing a link with an unspecified protocol. NOTE: this c...
CVE-2014-9041: Cross-Site Request Forgery (CSRF)
The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote attackers to conduct CSRF attacks...
PT-2015-4135
Name of the Vulnerable Software and Affected Versions ownCloud server versions prior to 5.0.18 ownCloud server versions 6.x prior to 6.0.6 ownCloud server versions 7.x prior to 7.0.3 Description The issue concerns the import functionality in the bookmarks application, which fails to validate CSRF...
CSRF in "bookmarks" application - ownCloud
Due to not verifying the CSRF token on the import functionality of the "bookmarks" application, it was vulnerable against CSRF attacks. The "bookmarks" application is disabled by default. An unauthenticated attacker could have used this to import bookmarks into the "bookmarks" application if the...
Server: CSRF in "bookmarks" application
Due to not verifying the CSRF token on the import functionality of the "bookmarks" application, it was vulnerable against CSRF attacks. The "bookmarks" application is disabled by default. An unauthenticated attacker could have used this to import bookmarks into the "bookmarks" application if the...
CVE-2014-3758
Cross-site scripting XSS vulnerability in the BibTex Publications sibibtex extension 0.2.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via vectors related to the import functionality...
Cross site scripting
Cross-site scripting XSS vulnerability in the BibTex Publications sibibtex extension 0.2.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via vectors related to the import functionality...
CVE-2014-3758
The CVE refers to a Cross-Site Scripting (XSS) vulnerability in the TYPO3 extension BibTex Publications (si_bibtex) version 0.2.3, exposed through the import functionality. The TYPO3 security bulletin TYPO3-EXT-SA-2014-020 documents affected versions (0.2.3 and below) and lists XSS (alongside SQL...
PT-2014-5483
Name of the Vulnerable Software and Affected Versions TYPO3 extension si bibtex version 0.2.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is related to the import functionality of the si bibtex extension...
CVE-2014-3758: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the BibTex Publications sibibtex extension 0.2.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via vectors related to the import functionality...
Slackware Advisory SSA:2005-310-02 KOffice/KWord
The remote host is missing an update as announced via advisory SSA:2005-310-02. OpenVAS Vulnerability Test $Id: esoftslkssa200531002.nasl 6598 2017-07-07 09:36:44Z cfischer $ Description: Auto-generated from the corresponding slackware advisory Authors: Thomas Reinke Copyright: Copyright c 2012...
PT-2012-4393
Name of the Vulnerable Software and Affected Versions HP ArcSight Connector appliance version 6.2.0.6244.0 HP ArcSight Logger appliance version 5.2.0.6288.0 Description A cross-site scripting XSS issue exists in the import functionality, allowing remote attackers to inject arbitrary web script or...
CVE-2012-2960: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the import functionality in HP ArcSight Connector appliance 6.2.0.6244.0 and ArcSight Logger appliance 5.2.0.6288.0 allows remote attackers to inject arbitrary web script or HTML via a crafted file...