1685 matches found
CVE-2020-36326
PHPMailer is affected in versions 6.1.8–6.4.0 by an object-injection vulnerability via Phar deserialization when using addAttachment with a UNC pathname. The issue arose after 6.1.8 fixed a UNC-path readability problem, unintentionally removing a block that previously prevented exploitation. Mult...
CVE-2020-36326
PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...
PT-2021-12009 · Phpmailer · Phpmailer
Name of the Vulnerable Software and Affected Versions: PHPMailer versions 6.1.8 through 6.4.0 Description: The issue allows object injection through Phar Deserialization via the addAttachment method with a UNC pathname. This is a reintroduction of an earlier problem due to an unrelated bug fix in...
PHPMailer 代码问题漏洞
PHPMailer is a PHP class library for sending emails. PHPMailer is vulnerable to a code issue that allows object injection via addAttachment with a UNC pathname via Phar deserialization. No details of the vulnerability are currently available...
Multiple vulnerabilities through filename manipulation in Archive_Tar
ArchiveTar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack such as file:// to overwrite files can still succeed. See: https://github.com/pear/ArchiveTar/issues/33...
GHSA-JH5X-HFHG-78JQ Deserialization of Untrusted Data in Archive_Tar
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. See: https://github.com/pear/ArchiveTar/issues/33...
Deserialization of Untrusted Data in Archive_Tar
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. See: https://github.com/pear/ArchiveTar/issues/33...
Amazon Linux AMI : php72, php73 (ALAS-2020-1425)
The version of php72 installed on the remote host is prior to 7.2.33-1.25. The version of php73 installed on the remote host is prior to 7.3.21-1.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1425 advisory. The flaw is in pharparsezipfile of ext/phar/zip.c. When...
CMS Made Simple 2.2.15 Shell Upload
1 Summary Affected software CMS Made Simple-2.2.15 Vendor URLhttp://www.cmsmadesimple.org/ Vulnerability File upload bypass with .phar extension lead to RCE 2 Vulnerability Description The vulnerability affect the FilePicker module, it is possible to bypass the restriction and upload a malicious...
CVE-2021-27817
A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix...
CVE-2021-27817
A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix...
Design/Logic Flaw
A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix...
CVE-2021-27817
A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix...
CVE-2021-27817
A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix...
CVE-2021-27817
CVE-2021-27817 describes a remote command execution in ShopXO 1.9.3 where an attacker can upload malicious code generated by Phar with a JPG suffix after manipulating the Phar suffix. Documents consistently reference this as a ShopXO RCE affecting version 1.9.3 and involving Phar-based payloads, ...
ShopXO 代码问题漏洞
ShopXO is an open source enterprise-level open source e-commerce system . A security vulnerability exists in shopxo 1.9.3, which originates from the presence of a remote command execution, which can be exploited by an attacker to upload malicious code generated by phar with a JPG suffix, modify t...
EulerOS 2.0 SP2 : php-pear (EulerOS-SA-2021-1345)
According to the version of the php-pear package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - ArchiveTar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack such as file:// to...
WordPress: Authenticated XXE
Description: The WordPress core Media Library does not securely parse XML content when running on PHP 8. By uploading a malicious .wav file, an authenticated attacker can trigger a XXE vulnerability which enables to read secret system files, DoS the web server, perform SSRF, or aim at Remote Code...
Exploit for CVE-2021-3129
laravel-exploits Exploit for CVE-2021-3129 Details: https://ww...
Concrete CMS: Phar Deserialization Vulnerability via Logging Settings
Vulnerability Description: The vulnerable code is located within the concrete/controllers/singlepage/dashboard/system/environment/logging.php script. Specifically, into the Logging::updatelogging method: public function updatelogging $config = $this-app-make'config'; $request = $this-request; if...