The vulnerability in the web application for managing email distributions, phplist, arises from the lack of restrictions on file downloads, allowing a perpetrator to execute arbitrary code.

The vulnerability of the phplist web application for managing email distributions is related to the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor to execute arbitrary code upon downloading the malicious plugin remotely...

phplist Remote Code Execution Vulnerability

phpList is an open source newsletter and email marketing software from phpList UK. A remote code execution vulnerability exists in phpList version 3.5.1, which stems from the product's failure to check for any file extensions stored in the plugin's zip file, and can be exploited by an attacker wh...

CVE-2020-22249

Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the plugin zip file, Uploading a malicious plugin which contains the php files with extensions like PHP,phtml,php7 will be copied to the plugins directory which would lead to the...

PhpList 代码问题漏洞

phpList is an open source newsletter and email marketing software from phpList UK. A remote code execution vulnerability exists in phpList version 3.5.1, which stems from the product's failure to check for any file extensions stored in the plugin's zip file, and can be exploited by an attacker wh...

Plugin archive directory traversal in Helm

The Helm core maintainers have identified an information disclosure vulnerability in Helm 3.0.0-3.2.3. Impact A traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It is possible for a malicious plugin author to inject a relative path into a plugin archive, and...

CVE-2021-29246

BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. The attacker must craft a malicious plugin file with special characters to upload the file outside of the restricted directory...

Directory traversal

BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. The attacker must craft a malicious plugin file with special characters to upload the file outside of the restricted directory...

CVE-2021-29246

BTCPay Server vulnerability CVE-2021-29246: an authenticated attacker with administrator privileges can exploit a directory traversal flaw in BTCPay Server versions up to 1.0.7.0 by uploading a specially crafted malicious plugin file to escape the restricted directory, enabling code execution on ...

Nagios XI - Authenticated Remote Command Execution Exploit

This Metasploit module exploits a vulnerability in Nagios XI versions before 5.6.6 in order to execute arbitrary commands as root. The module uploads a malicious plugin to the Nagios XI server and then executes this plugin by issuing an HTTP GET request to download a system profile from the serve...

Nagios XI Authenticated Remote Command Execution

This module exploits a vulnerability in Nagios XI before 5.6.6 in order to execute arbitrary commands as root. The module uploads a malicious plugin to the Nagios XI server and then executes this plugin by issuing an HTTP GET request to download a system profile from the server. For all supported...

New Relic: Urgent! Stored XSS at plugin's violations leading to account takeover

Hey team, I have found a stored XSS which is fired at plugin's Violations page. This vulnerability can be used by malicious plugin maker to take over any account which installs this malicious plugin. Vulnerability details The Violations page contain the following script inside its source code: ht...

Cross-site Scripting (XSS)

Mozilla Firefox and Thunderbird is vulnerable to cross-site scripting XSS. The use of valueOf method to shadow the location object window.location is not prevented, allowing for remote attackers to inject arbitrary Javascript into a victim's web browser via a malicious plugin...

Huawei HiRouter-CD20 and WS5200 Path Traversal Vulnerability

Huawei HiRouter-CD20 and WS5200 are both home router products released by Huawei China. A path traversal vulnerability exists in the Huawei HiRouter-CD20 HiRouter-CD20-10 prior to version 1.9.6 and the WS5200 WS5200-10 prior to version 1.9.6, which stems from insufficient checksums when the progr...

WordPress Download Manager 2.9.60 Cross Site Request Forgery

Exploit Title: WordPress Download Manager CSRF Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: https://www.wpdownloadmanager.com/ Software Link: https://wordpress.org/plugins/download-manager Version: 2.9.60 Tested on:...

Memory corruption with malicious NPAPI plugin — Mozilla

The CESG, the Information Security Arm of GCHQ, reported a dangling pointer dereference within the Netscape Plugin Application Programming Interface NPAPI that could lead to the NPAPI subsystem crashing. This issue requires a maliciously crafted NPAPI plugin in concert with scripted web content,...

Openfire <= 3.6.0a Admin Console Authentication Bypass

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

Shylock banking malware spreads via Skype

The banking Trojan known as Shylock has been updated with new functionality, including the ability to spread over Skype. The program was discovered in 2011 that steals online banking credentials and other financial information from infected computers. Shylock, named after a character from...

Shylock banking malware spreads via Skype

The banking Trojan known as Shylock has been updated with new functionality, including the ability to spread over Skype. The program was discovered in 2011 that steals online banking credentials and other financial information from infected computers. Shylock, named after a character from...