CVE-2021-36766

Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/singlepage/dashboard/system/environment/logging.php Logging::updatelogging method. User input passed through the logFile request parameter is not properly sanitized before being used in a ca...

USN-5006-2 php5, php7.0 vulnerabilities

USN-5006-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that PHP incorrectly handled certain PHAR files. A remote attacker could possibly use this issue to cause PHP to...

USN-5006-1 php7.2, php7.4 vulnerabilities

It was discovered that PHP incorrectly handled certain PHAR files. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. CVE-2020-7068 It wa...

Ubuntu 18.04 LTS / 20.04 LTS : PHP vulnerabilities (USN-5006-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5006-1 advisory. It was discovered that PHP incorrectly handled certain PHAR files. A remote attacker could possibly use this issue to cause PHP to crash,...

The vulnerability of the elFinder file manager stems from the incorrect implementation of authentication mechanisms, allowing attackers to execute arbitrary code.

The vulnerability of the elFinder file manager is related to the unlimited loading of files of a dangerous type. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created .phar file...

GetSimple CMS Remote Code Execution Vulnerability (CNVD-2021-45301)

GetSimple CMS is an XML-based, completely self-contained, streamlined content management system. A remote code execution vulnerability exists in admin/upload.php in GetSimple CMS versions prior to 3.3.16. An attacker can exploit this vulnerability to achieve remote code execution via phar files...

CVE-2021-28976

Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess...

CVE-2021-28976

Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess...

CVE-2021-28976

CVE-2021-28976 affects GetSimpleCMS versions prior to 3.3.16, with a remote code execution vulnerability in admin/upload.php exploitable through PHAR file uploads. The connected sources confirm a phar-based attack chain leading to RCE (e.g., PoCs and exploits in Exploit-DB/PacketStorm) and indica...

getsimplecms 代码问题漏洞

GetSimple CMS is an XML-based, completely self-contained, streamlined content management system. A remote code execution vulnerability exists in admin/upload.php in GetSimple CMS versions prior to 3.3.16. An attacker can exploit this vulnerability to achieve remote code execution via phar files...

The vulnerability of the Admidio membership management and access control application lies in its ability to download files of a dangerous type without limitation, allowing a perpetrator to execute arbitrary code.

The vulnerability of the Admidio membership management and access control application lies in the ability to download unlimited files of a dangerous type. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code using specially created .phar files...

CiviCRM 5.22.0 - Code Execution Vulnerability Chain Explained

During our vulnerability research on the largest CMS systems we came across CiviCRM last year. It’s an open source CRM plugin for the most popular CMS systems like Wordpress, Joomla, Drupal, and Backdrop. CiviCRM is specifically designed for the needs of non-profit, non-governmental, and advocacy...

CVE-2020-36388

In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive...

CVE-2020-36388

In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive...

DEBIAN-CVE-2020-36388

In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive...

Design/Logic Flaw

In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive...

CVE-2020-36388

In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive...

CVE-2020-36388

CVE-2020-36388 affects CiviCRM: versions prior to 5.21.3 and 5.22.x through 5.24.x prior to 5.24.3 expose a crafted PHAR archive upload that enables arbitrary code execution. The root cause is vulnerability in handling PHAR archives which allows remote code execution when a user can upload a mali...

CVE-2020-36388

In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive...

Studio-42 Elfinder Remote Code Execution Vulnerability

Studio-42 Elfinder is an open source web file manager. Studio-42 Elfinder suffers from a remote code execution vulnerability that stems from a server error when parsing .phar into php. An attacker could give cause code remote execution through this vulnerability...