CVE-2020-1200

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint...

PT-2020-3989 · Microsoft · Sharepoint Foundation +1

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server, SharePoint Foundation, and SharePoint Enterprise Server affected versions not specified Description: A remote code execution issue exists in Microsoft SharePoint due to the software's failure to properly check the...

PT-2020-3907 · Microsoft · Sharepoint Foundation +1

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Foundation affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description: A remote code execution issue exis...

GHSA-87QW-7V97-W34R Malicious Package in asinc

All versions of asinc typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was...

Teltonika TRB245 Improper Input Validation Vulnerability

Teltonika TRB245 is a cellular network gateway product from Teltonika Lithuania. An improper input validation vulnerability exists in the firmware TRB2R00.02.04.01 of the Teltonika TRB245. A remote attacker can exploit this vulnerability to gain root privileges by uploading a malicious package fi...

CVE-2020-5772

Improper Input Validation in Teltonika firmware TRB2R00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious package file...

CVE-2020-15525

GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint...

Improper access control

GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint...

CVE-2020-15525

GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint...

CVE-2020-15525

Removed by vendor...

PT-2020-14477 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 11.3 through 13.1.2 Description: The issue is related to Incorrect Access Control in GitLab EE due to the Maven package upload endpoint. This allows for unauthorized access. Recommendations: For GitLab EE versions 11.3...

CVE-2020-15525: Undefined Security Weakness

GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint...

Design/Logic Flaw

In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details...

CVE-2019-1961

A vulnerability in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system OS of an affected device. The vulnerability is due to the improper input validation of tar packages uploaded through the W...

CVE-2018-17289

An XML external entity XXE vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to read arbitrary files via crafted XML inside an imported package configuration .ZIP file within the Kofax/KFS/Admin/PackageService/package/uploa...

CVE-2018-17289

An XML external entity XXE vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to read arbitrary files via crafted XML inside an imported package configuration .ZIP file within the Kofax/KFS/Admin/PackageService/package/uploa...

PT-2019-9451

Name of the Vulnerable Software and Affected Versions Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 Description A vulnerability exists that allows remote authenticated users to read arbitrary files. This is achieved by crafting XML inside an imported package configurati...

PT-2019-1402

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Microsoft SharePoint Foundation affected versions not specified Description A remote code execution issue exists...

CVE-2017-9443

BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and...

CVE-2017-5965

The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZIP archive in which a .asp file has a ..\ in its pathname, visiting sitecore/shell/applications/install/dialogs/Upload%20Package/UploadPackage2.aspx to upload...