CVE-2020-19510

Textpattern 4.7.3 contains an aribtrary file load via the fileinsert function in include/txpfile.php...

Textpattern 代码问题漏洞

Textpattern is a free open source content management system based on PHP and MySQL. Textpattern has an arbitrary file upload vulnerability. An attacker can use the fileinsert function in include/txpfile.php to upload arbitrary files...

WordPress Include Me plugin <= 1.2.1 - Path traversal and Local File Inclusion (LFI) vulnerability leading to Remote Code Execution (RCE)

Path traversal and Local File Inclusion LFI vulnerability leading to Remote Code Execution RCE discovered by Mesut Cetin in WordPress Include Me plugin versions = 1.2.1. Solution Update the WordPress Include Me plugin to the latest available version at least 1.2.2...

CVE-2020-19510: Unrestricted Upload of File with Dangerous Type

Textpattern 4.7.3 contains an aribtrary file load via the fileinsert function in include/txpfile.php...

PT-2021-10363

Name of the Vulnerable Software and Affected Versions: Textpattern version 4.7.3 Description: The issue concerns an arbitrary file load via the file insert function in include/txp file.php. Recommendations: For Textpattern version 4.7.3, consider disabling the file insert function in include/txp...

CVE-2021-32681

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...

PYSEC-2021-103

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...

PT-2021-19853

Name of the Vulnerable Software and Affected Versions Wagtail versions 2.13 through 2.13.1 Wagtail versions 2.12 through 2.12.4 Wagtail versions prior to 2.11.8 Description A cross-site scripting issue exists when the % include block % template tag is used to output the value of a plain-text...

CVE-2020-20907

MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/languagegeneral.class.php and app/system/include/function/file.func.php...

CVE-2020-20907: Improper Limitation of a Pathname to a Restricted Directory

MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/languagegeneral.class.php and app/system/include/function/file.func.php...

GHSA-QM28-7HQV-WG5J OS Command Injection in ng-packagr

The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option...

CVE-2021-32099: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the pandoraconsole component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chartgenerator.php sessionid parameter, leading to a login bypass...

SUSE: Security Advisory (SUSE-SU-2018:2162-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

libucl:ucl_add_string_fuzzer: Heap-buffer-overflow in ucl_hash_search

Project: https://github.com/vstakhov/libucl.git Detailed Report: https://oss-fuzz.com/testcase?key=5131192061001728 Project: libucl Fuzzing Engine: afl Fuzz Target: ucladdstringfuzzer Job Type: aflasanlibucl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x61100005a620...

Code injection

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with for example OS commands in the opt parameter...

CVE-2020-15568

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with for example OS commands in the opt parameter...

CVE-2020-15568: Improper Control of Dynamically-Managed Code Resources

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with for example OS commands in the opt parameter...

UBUNTU-CVE-2021-20187

It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication...

CVE-2021-20187

It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication...

CVE-2021-20187

CVE-2021-20187 affects Moodle prior to versions 3.10.1, 3.9.4, 3.8.7 and 3.5.16. The issue allows site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication. The connected documents confirm the vulnerable condition and the root cause, but do not p...