12073 matches found
CVE-2022-3881
The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and...
Unauthenticated Remote Command Execution on corebos due to exposed install files.
Description While analysing corebos source-code, I found a file that looked interesting: - install/MigrationDbBackup.php This file contains the following snippet of code: php ?php /+ The contents of this file are subject to the vtiger CRM Public License Version 1.0 "License"; You may not use this...
CVE-2022-3881: Cross-Site Request Forgery (CSRF)
The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and...
PT-2022-27415
Name of the Vulnerable Software and Affected Versions CHICKEN versions 5.x before 5.3.1 Description The issue allows arbitrary OS command execution during package installation via escape characters in a .egg file. This is due to a problem in the egg-compile.scm file. Recommendations For CHICKEN...
Exploit for CVE-2022-36537
CVE-2022-36537 Summary R1Soft Server Backup Manager uses t...
Exploit for Path Traversal in Apache Http_Server
Exploit for Apache2 Exploit for path transversal vulnerabilit...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the installModule function. Note: To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have the...
grunt-yellowlabtools (>=0.0.1, <=1.2.1), install-is (>=1.4.0, <=1.4.2) +3 more potentially affected by CVE-2022-25906 via is-http2 (>=1.0.4, <=1.2.0)
is-http2 NPM version =1.0.4, =0.0.1, =1.4.0, =1.0.0, =1.10.0, =1.13.4 Source cves: CVE-2022-25906 Source advisory: SNYK:JS-ISHTTP2-3153878...
PT-2023-6466 · Samsung · Galaxy Store
Name of the Vulnerable Software and Affected Versions: Galaxy Store versions prior to 4.5.49.8 Description: The issue is related to improper access control in the Galaxy Store application, which is associated with incorrect default permissions. This allows a local attacker to install applications...
WordPress plugin Advanced Import has a vulnerability related to cross-site request fraud.
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
Fedora: Security Advisory for fastnetmon (FEDORA-2022-5d37367673)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2022-42718
Incorrect default permissions in the installation folder for NI LabVIEW Command Line Interface CLI may allow an authenticated user to potentially enable escalation of privilege via local access...
Important: Red Hat Security Advisory: kpatch-patch security update
An update for kpatch-patch is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...
PT-2025-37571
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak was identified in the vkms init function within the kernel's drm/vkms module. This leak occurs when the vkms create function fails, but the memory allocated for config with...
PT-2022-25638
Name of the Vulnerable Software and Affected Versions Apache Airflow Spark Provider versions prior to 4.0.0 Apache Airflow versions prior to 2.3.0 Description The issue is related to an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apach...
@aeppic/install-build-server (>=1.2.0, <=1.9.8), @aeppic/install-repository-server (>=1.2.2, <=2.0.2) +145 more potentially affected by CVE-2022-41919 via fastify (>=3.0.0, <=3.29.3)
fastify NPM version =3.0.0, =1.2.0, =1.2.2, =0.0.46, =0.0.5, =1.0.0, =2.0.0, =1.1.1, =1.0.0, =1.0.0, =1.0.0, =4.23.1, =2.7.0, =1.0.0, =1.3.0 - @bronosorg/graph-indexer-service 1.0.0 and more Source cves: CVE-2022-41919 Source advisory: GHSA-3FJJ-P79J-C9HH...
MAL-2022-3854 Malicious code in install-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51f53b367d37dba07b58ec3eca02e4d10b8cc63289e1b83775033b77b6b40798 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
StopBadBots < 7.24 - Subscriber+ Arbitrary Plugin Installation
The plugin does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org Run the below command in the developer console of the web browser while being on the blog as a...
Fedora: Security Advisory for js-jquery-ui (FEDORA-2022-7291b78111)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
