CVE-2022-1977 WP Ultimate CSV Importer < 6.5.3 - Admin+ Blind SSRF

The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks...

PT-2022-14230 · WordPress · Import Export All Wordpress Images

Name of the Vulnerable Software and Affected Versions: Import Export All WordPress Images, Users & Post Types WordPress plugin versions prior to 6.5.3 Description: The issue concerns the lack of full validation for files to be imported via URL, which could allow high-privilege users, such as...

PT-2022-13973 · WordPress · Html2Wp

Name of the Vulnerable Software and Affected Versions: HTML2WP WordPress plugin versions prior to 1.1 Description: The issue concerns a lack of authorization and CSRF checks when importing files, along with a failure to validate these files. As a result, unauthenticated attackers can upload...

PT-2022-3467 · Watchguard · Watchguard Fireware

Name of the Vulnerable Software and Affected Versions: WatchGuard Fireware OS versions prior to 12.1.4 WatchGuard Fireware OS versions prior to 12.5.10 WatchGuard Fireware OS versions prior to 12.8.1 Description: An argument injection issue in the diagnose and import pac commands allows an...

PT-2022-5982 · Atlassian +1 · Jira Service Management Server +2

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Service Management Server and Data Center versions prior to 4.13.20 Atlassian Jira Service Management Server and Data Center versions 4.14.0 through 4.20.8 Atlassian Jira Service Management Server and Data Center versions 4.21....

CVE-2022-31749: WatchGuard Authenticated Arbitrary File Read/Write (Fixed)

A remote and low-privileged WatchGuard Firebox or XTM user can read arbitrary system files when using the SSH interface due to an argument injection vulnerability affecting the diagnose command. Additionally, a remote and highly privileged user can write arbitrary system files when using the SSH...

WordPress Import CSV Files plugin <= 1.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Benachi in WordPress Import CSV Files plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of June 16, 2022 and is not available for download. This closure is temporary, pending a full review...

Malicious code in arm-storageimportexport (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d0bb3f0260baef002d5a82c7a12b74158ab26a3382383bd5152f138c7d224cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-arm-storageimportexport-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7b652c2bfd2234d5572f74a8c829d6ba3c5bc908f86b849767cf67e9f780db8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1290 Malicious code in azure-arm-storageimportexport-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7b652c2bfd2234d5572f74a8c829d6ba3c5bc908f86b849767cf67e9f780db8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cache Images < 3.2.1 - Image Upload / Import via CSRF

The plugin does not implement nonce checks, which could allow attackers to make any logged user upload images via a CSRF attack. PoC Allows import of any images with any user level...

Cache Images < 3.2.1 - Image Upload / Import via CSRF

The plugin does not implement nonce checks, which could allow attackers to make any logged user upload images via a CSRF attack. Allows import of any images with any user level. document.getElementById"test".submit; document.getElementById"test".submit; document.getElementById"test".submit;...

CVE-2022-23071

In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery SSRF, in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information...

CVE-2022-23071

In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery SSRF, in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information...

Server side request forgery (ssrf)

In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery SSRF, in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information...

Recipes 代码问题漏洞

Recipes is an application for managing recipes, planning meals, creating shopping lists, and more! A code issue vulnerability exists in Recipes versions 0.9.1 through 1.2.5 that stems from the Import Recipe feature being vulnerable to a server request forgery attack. When an attacker enters a...

Gitlab vulnerable to server-side request forgery

Overview Gitlab contains a server-side request forgery vulnerability CWE-918 through the Project Import feature. Kanta Nishitani of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to the developer and coordinated. After coordination was completed, this case was reported to IPA, and...

SSRF via Import URL

Description While importing CSV and Excel file via an URL, the server does not validate requests properly that's how the attacker can able to make requests to internal servers and access the contents. Proof of Concept 1. Go to any project 2. From Dashboard, click on Add / Import CSV or Microsoft...

CVE-2022-32258

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application contains an older feature that allows to import device configurations via a specific endpoint. An attacker could use this vulnerability for information disclosure...

CVE-2022-32258

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application contains an older feature that allows to import device configurations via a specific endpoint. An attacker could use this vulnerability for information disclosure...