WordPress Media File Organizer plugin directory traversal vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A directory traversal vulnerability exists in version 1.0.1 of the Media File Organizer plugin for...

UVI-2021-1001138 psi: Fix psi state corruption when schedule() races with cgroup move

psi: Fix psi state corruption when schedule races with cgroup move This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.13 by commit...

GSD-2021-1001138 psi: Fix psi state corruption when schedule() races with cgroup move

psi: Fix psi state corruption when schedule races with cgroup move This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.13 by commit...

PT-2021-25609

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.13 Description: The issue concerns a potential security vulnerability related to psi state corruption when schedule races with cgroup move. The actual impact and attack plausibility have not yet been proven...

PT-2021-29603

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.13 Description The issue concerns a potential security vulnerability related to psi state corruption when schedule races with cgroup move. The actual impact and attack plausibility have not yet been proven...

CVE-2020-24144

Directory traversal in the Media File Organizer aka media-file-organizer plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outside the web root folder via the items parameter in a move operation...

Directory traversal

Directory traversal in the Media File Organizer aka media-file-organizer plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outside the web root folder via the items parameter in a move operation...

CVE-2020-24144

Directory traversal in the Media File Organizer aka media-file-organizer plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outside the web root folder via the items parameter in a move operation...

CVE-2020-24144: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in the Media File Organizer aka media-file-organizer plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outside the web root folder via the items parameter in a move operation...

PT-2021-1527 · Linux +9 · Linux Kernel +9

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.13.3 Description: The issue is related to a use-after-free via a stale TLB because an rmap lock is not held during a PUD move in the mm/mremap.c file. This could lead to local escalation of privilege in the...

OPENSUSE-SU-2021:0907-1 Security update for cryptctl

This update for cryptctl fixes the following issues: Update to version 2.4: - CVE-2019-18906: Client side password hashing was equivalent to clear text password storage bsc1186226 - First step to use plain text password instead of hashed password. - Move repository into the SUSE github organizati...

PT-2021-10202 · Gnuboard5 · Gnuboard5

Name of the Vulnerable Software and Affected Versions: gnuboard5 versions prior to 5.3.2.8 Description: The issue is related to a Cross Site Scripting XSS vulnerability. It can be exploited via the act parameter in the "bbs/move update.php" endpoint. Recommendations: For versions prior to 5.3.2.8...

gnuboard5 跨站脚本漏洞

GNUBOARD5 is a Web forum system based on PHP and MySQL. A cross-site scripting vulnerability exists in GNUBOARD5 5.3.2.8 and earlier versions. The vulnerability can be exploited to conduct cross-site scripting attacks via the act parameter in bbs/moveupdate.php...

The vulnerabilities of the functions MovePage::isValidMoveTarget(), Title::getArticleID(), and MovePage::moveToInternal() in the software for implementing the MediaWiki hypertext environment allow attackers to compromise the integrity of the protected information.

The vulnerabilities of the functions MovePage::isValidMoveTarget, Title::getArticleID, and MovePage::moveToInternal in the MediaWiki software environment for implementing a hypertext environment are related to deficiencies in access control. Exploiting these vulnerabilities could allow an attacke...

PT-2021-12112 · Unknown · Susi.Ai Server

Name of the Vulnerable Software and Affected Versions: SUSI.AI Server versions prior to d27ed0f Description: The issue is due to insufficient input validation, leading to a directory traversal vulnerability. This allows an attacker to retrieve any admin config and file readable by the app...

SUSE: Security Advisory (SUSE-SU-2019:2330-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-30487

In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation...

CVE-2021-30487: Undefined Security Weakness

In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation...

CVE-2021-30159

In the mediawiki package, users can bypass intended restrictions on deleting pages in certain "fast double move" situations...

DEBIAN-CVE-2021-30159

An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget uses FOR UPDATE, but it's only called if Title::getArticleID returns non-zero...