166 matches found
WordPress Plugin Better Search 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...
Incorrect Authorization to Stored XSS in Import User Role function
Description The application incorrectly checks user permissions, enabling the attacker to use the 'import file user roles' functionality, which contains a payload for executing JavaScript code, without requiring any specific privileges. Proof of Concept Step1: Even without the privilege to manage...
CVE-2021-4372: Improper Neutralization of Input During Web Page Generation
The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.1. This is due to missing sanitization on the settings imported via the import function. This makes it possible for unauthenticated attackers to...
WordPress Plugin WooCommerce Dynamic Pricing and Discounts 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
PT-2023-24405 · Axtls · Axtls
Name of the Vulnerable Software and Affected Versions: axTLS version 2.1.5 Description: A heap buffer overflow was discovered in the bi import function, located in axtls-code/crypto/bigint.c, which allows attackers to cause a Denial of Service DoS when parsing a private key. Recommendations: For...
The vulnerability of Firefox and Firefox ESR browsers, related to the lack of protection for service data, allows attackers to disclose protected information.
The vulnerability of Firefox and Firefox ESR browsers is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to disclose protected information through the import function...
PT-2023-16820 · WordPress · Http Headers
Name of the Vulnerable Software and Affected Versions: HTTP Headers WordPress plugin versions prior to 1.18.8 Description: The issue concerns an import functionality in the HTTP Headers WordPress plugin that executes arbitrary SQL on the server, leading to an SQL Injection vulnerability. This...
SUSE CVE-2020-28599
A stack-based buffer overflow vulnerability exists in the importstl.cc:importstl functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...
SUSE CVE-2022-0496
A vulnerbiility was found in Openscad, where a DXF-format drawing with particular not necessarily malformed! properties may cause an out-of-bounds memory access when imported using import...
CVE-2023-24028
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function...
PT-2023-19369 · Misp · Misp
Name of the Vulnerable Software and Affected Versions: MISP version 2.4.167 Description: The issue concerns incorrect access control in the ACLComponent.php file for the decaying import function. This affects the app/Controller/Component/ACLComponent.php component. Recommendations: For MISP versi...
CVE-2023-24028
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function...
CVE-2023-24028
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function...
The vulnerability of the import function of the administrative interface module of Cisco Firepower Management Center software allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the import function of the administrative interface module of Cisco Firepower Management Center FMC is related to insufficient validation of XML files’ syntax. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information through ...
Local File Read through Improper Filename Validation
Description This vulnerability occur because there is no filename validation on logoimagelogin and logoimageheader on import and export function. Attacker can use path traversal payload to leak local file such as /etc/passwd or froxlor config file. Proof of Concept 1. Go to import function on...
CVE-2022-45025
Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function...
Markdown Preview Enhanced 操作系统命令注入漏洞
Markdown Preview Enhanced is a super-powerful markdown extension by the individual developer Yiyi Wang. An operating system command injection vulnerability exists in Markdown Preview Enhanced version v0.6.5 and v0.19.6. An attacker can exploit this vulnerability to perform command injection via t...
CVE-2022-20938: Improper Restriction of XML External Entity Reference
A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to view sensitive information. This vulnerability is due to insufficient validation of the XML syntax when importing a...
