939 matches found
PT-2023-13793 · WordPress · Wp User
Name of the Vulnerable Software and Affected Versions: WP User WordPress plugin versions prior to 7.0 Description: The issue is related to a SQL injection that can be exploited by unauthenticated users due to improper sanitization and escaping of a parameter in a SQL statement. Recommendations: F...
GHSA-F5C5-HMW9-V8HX Unzip vulnerable to path traversal
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
CVE-2020-36559
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
Directory traversal
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
CVE-2020-36566 Path traversal in github.com/whyrusleeping/tar-utils
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
CVE-2020-36561 Path traversal in github.com/yi-ge/unzip
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
CVE-2020-36559
CVE-2020-36559 describes a path-traversal vulnerability in the Go web framework aah (HTTPEngine.Handle). The root cause is improper sanitization of user input, allowing an attacker to read files outside the target directory that the server has permission to read. The vulnerability is documented a...
CVE-2020-36559 Path Traversal in aahframe.work
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
CVE-2019-25073 Path traversal in github.com/goadesign/goa
Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory...
CVE-2018-25046 Path traversal in code.cloudfoundry.org/archiver
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via the boxAdd function due to improper input sanitization. PoC js vagrant = require"vagrant.js"; vagrant.boxAdd";touch EXPLOITED;", "", functionboxArr, stderr; Remediation There is no fixed version for vagrant.js...
CVE-2022-24377 Command Injection
The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization...
SQL Injection
net.mingsoft, ms-mcms is vulnerable to SQL injection. The vulnerability exists due to improper sanitization in the get function of categoryaction.java due to manipulation in the argument sqlWhere, via the /cms/category/list endpoint...
Cross site scripting
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formatted fields...
UBUNTU-CVE-2022-44637
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user...
Design/Logic Flaw
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user...
CVE-2022-44637
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user...
CVE-2022-44637
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user...
