PT-2022-38131

Уязвимость функции ipcm init sk модуля include/net/ip.h ядра операционной системы Linux связана с раскрытием конфиденциальной информации. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

CVE-2022-1560: Improper Limitation of a Pathname to a Restricted Directory

The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal err...

GHSA-65J5-VPM7-6XP4 Smarty Path Traversal Vulnerability

Smarty before 3.1.33-dev-4 allows attackers to bypass the trusteddir protection mechanism via a file:./../ substring in an include statement...

GHSA-737W-MH58-CXJP Arbitrary code execution in Apache Struts

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the 1 URL or 2 A tag...

GHSA-7GHM-RPC7-P7G5 Code injection in Apache Struts

A vulnerability introduced by forcing parameter inclusion in the URL and Anchor Tag allows remote command execution, session access and manipulation and XSS attacks. both the s:url and s:a tag provide an includeParams attribute. The main scope of that attribute is to understand whether includes...

PT-2022-7142

Name of the Vulnerable Software and Affected Versions XML Sitemap Generator for Google WordPress plugin versions prior to 2.0.4 Description The issue arises from the plugin's failure to validate a parameter, which can be set to an arbitrary value. This can lead to cross-site scripting XSS via err...

CVE-2022-1392

The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues...

CVE-2022-1392: Improper Limitation of a Pathname to a Restricted Directory

The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues...

GSD-2022-1001603 mm/kmemleak: reset tag when compare object pointer

mm/kmemleak: reset tag when compare object pointer This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

CVE-2022-27157

pearweb 1.32 is suffers from a Weak Password Recovery Mechanism via include/users/passwordmanage.php...

PT-2022-18255

Name of the Vulnerable Software and Affected Versions pearweb versions prior to 1.32 Description The issue is related to a weak password recovery mechanism. It is specifically exploitable via the include/users/passwordmanage.php endpoint. Recommendations For versions prior to 1.32, update to...

PHP Smarty Template Handler Unauthorized Access

The vulnerability of PHP Smarty templates is related to deficiencies in handling arrays of trusted directories $trusteddir. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information using the include operator in the file:./../../../../../etc/passwd...

CVE-2022-27133

zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...

CVE-2022-27126

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php...

CVE-2022-27126

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php...

CVE-2022-27133

zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...

Sql injection

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php...

Arbitrary file deletion

zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...

PT-2022-18241

Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description The issue is related to an arbitrary file deletion vulnerability. This vulnerability can be exploited via the "/include/up.php" API endpoint. Recommendations For zbzcms version 1.0, as a temporary workaround,...

PT-2022-18235

Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description A SQL injection issue was found in zbzcms via the art parameter at the "/include/make.php" API endpoint. Recommendations For zbzcms version 1.0, avoid using the art parameter in the "/include/make.php" endpoint...