CVE-2024-3020

The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the 'shortcode' parameter. This allows authenticated attackers, with administrator-level access to inject a PHP Object. If a POP chain is prese...

CVE-2024-3020 Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Admin+) PHP Object Injection

The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the 'shortcode' parameter. This allows authenticated attackers, with administrator-level access to inject a PHP Object. If a POP chain is prese...

PT-2024-23248 · Shapedplugin · Carousel +3

Name of the Vulnerable Software and Affected Versions: Plugin versions up to and including 2.6.3 Description: The issue allows authenticated attackers with administrator-level access to inject a PHP Object via deserialization of untrusted input in the import function using the shortcode parameter...

CVE-2024-3020: Deserialization of Untrusted Data

The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the 'shortcode' parameter. This allows authenticated attackers, with administrator-level access to inject a PHP Object. If a POP chain is prese...

CVE-2023-6944 Rhdh: catalog-import function leaks credentials to frontend

A flaw was found in the Red Hat Developer Hub RHDH. The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gainin...

CVE-2023-7037

A vulnerability was found in automad up to 1.10.9. It has been declared as critical. This vulnerability affects the function import of the file FileController.php. The manipulation of the argument importUrl leads to server-side request forgery. The attack can be initiated remotely. The exploit ha...

automad Code Issues Vulnerabilities

automad is a flat file content management system and template engine. A code issue vulnerability exists in automad 1.10.9 and earlier versions, which stems from a Server Request Forgery SSRF vulnerability in the function import in the file FileController.php...

PT-2023-32845 · Automad · Automad

Name of the Vulnerable Software and Affected Versions: automad versions up to 1.10.9 Description: A critical issue affects the import function in the FileController.php file, where the manipulation of the importUrl argument leads to server-side request forgery. This can be initiated remotely and...

Improper Authorization in Import Question function

Description The Import Question function does not check user permissions, allowing users to import questions into any survey without requiring authorization Proof of Concept Step 1: We have user1 who has no permissions Step 2: User1 performs importing questions into the survey by creating a reque...

PT-2023-5922 · Sap · Sap Powerdesigner Client

Name of the Vulnerable Software and Affected Versions: SAP PowerDesigner Client version 16.7 Description: The issue is related to the import function of BPMN files in the Business Process Modeling BPM module of the SAP PowerDesigner enterprise architecture modeling tool. It does not sufficiently...

Arbitrary Code Execution

import-in-the-middle is vulnerable to Arbitrary Code Execution. The vulnerability exists due to the lack of sanitization in the getSource function of hook.js, which allows an attacker to inject and execute malicious code in the import function...

CVE-2023-38704

import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. Prior to version 1.4.2, it allows for...

CVE-2023-38704: Improper Input Validation

import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. Prior to version 1.4.2, it allows for...

CVE-2023-30564

Alaris Systems Manager does not perform input validation during the Device Import Function...

Input validation

Alaris Systems Manager does not perform input validation during the Device Import Function...

Session fixation

A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session...

CVE-2023-30563

BD Alaris Systems Manager (SM) versions 12.3 and prior are affected by CVE-2023-30563, an improper input validation vulnerability that allows a malicious file uploaded via the System Manager User Import Function to trigger a Cross-Site Scripting (XSS) condition and hijack a user session. The CVSS...

CVE-2023-30563: Improper Neutralization of Input During Web Page Generation

A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session...

CVE-2023-30564: Improper Neutralization of Input During Web Page Generation

Alaris Systems Manager does not perform input validation during the Device Import Function...

BD Alaris System with Guardrails Suite MX 跨站脚本漏洞

The BD Alaris System with Guardrails Suite MX is a medical device from Biddy Medical BD, Inc. A security vulnerability exists in the BD Alaris System with Guardrails Suite MX that stems from Alaris Systems Manager not performing input validation during the device import function...