235 matches found
PT-2023-6470 · Unknown · I-Doit Open +1
Name of the Vulnerable Software and Affected Versions: I-doit pro versions 25 and below I-doit open versions 25 and below Description: The issue is related to weak password requirements for Administrator account creation in the affected software. This weakness allows attackers to easily guess...
Textpattern CMS Path Traversal Vulnerability
Textpattern CMS is a Php-based content management system from the Textpattern team. A security vulnerability exists in Textpattern CMS version v4.8.8. A remote attacker can exploit the vulnerability to execute arbitrary code and access sensitive information via the plugin upload function...
CVE-2023-36220
CVE-2023-36220 is a directory traversal vulnerability affecting Textpattern CMS v4.8.8. The issue allows a remote authenticated attacker to execute arbitrary code and access sensitive information via the plugin Upload function. Multiple connected sources corroborate the affected product/version a...
Exploit for Weak Password Requirements in I-Doit
CVE-2023-37756 – Weak Password Requirement in admin-center lea...
OpenCart SQL注入漏洞
OpenCart is an open source online shopping system that allows you to build your own online store. The system is simple and easy to use and supports all kinds of data import and export , including product information , user orders , products and so on. Through OpenCart users can easily complete th...
Jenkins: Temporary plugin file created with insecure permissions
A flaw was found in Jenkins. Jenkins creates a temporary file when a plugin is uploaded from an administrator’s computer. If these permissions are overly permissive, they may allow attackers with access to the Jenkins controller file system to read and write the file before it is installed in...
Textpattern CMS 4.8.8 Command Injection
Exploit Title: Textpattern CMS v4.8.8 - Command Injection Authenticated Date: 2023-06-15 Exploit Author: tmrswrr Vendor Homepage: https://textpattern.com/ Software Link: https://textpattern.com/filedownload/118/textpattern-4.8.8.zip Version: v4.8.8 Tested : https://release-demo.textpattern.co/ --...
Jenkins: Temporary plugin file created with insecure permissions
A flaw was found in Jenkins. Jenkins creates a temporary file when a plugin is uploaded from an administrator’s computer. If these permissions are overly permissive, they may allow attackers with access to the Jenkins controller file system to read and write the file before it is installed in...
CVE-2023-27899
A flaw was found in Jenkins. Jenkins creates a temporary file when a plugin is uploaded from an administrator’s computer. If these permissions are overly permissive, they may allow attackers with access to the Jenkins controller file system to read and write the file before it is installed in...
GHSA-HF9H-VV4M-2F33 Incorrect Authorization in Jenkins Core
Jenkins creates a temporary file when a plugin is uploaded from an administrator’s computer. Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 creates this temporary file in the system temporary directory with the default permissions for newly created files. If these...
CVE-2022-42925
There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker with the role of student to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerability could lead to a remote code injection...
PT-2022-26659 · Forma Lms · Forma Lms
Name of the Vulnerable Software and Affected Versions: Forma LMS versions 3.1.0 and earlier Description: The issue allows an authenticated attacker with the role of student to privilege escalate and upload a Zip file through the plugin upload component. This could lead to a remote code injection...
CVE-2022-42189
Emlog Pro 1.6.0 plugins upload suffers from a remote code execution RCE vulnerability...
Exploit for Improper Preservation of Permissions in Processmaker
This repository has be archived and moved to: https://github.com...
GHSA-5469-C5P2-XV5G Dataease before 1.11.2 allows arbitrary code execution via crafter plugin
An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. Version 1.11.2 contains a patch for the problem...
CVE-2022-34113
An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin...
CVE-2022-34113
An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin...
PT-2022-22011 · Dataease · Dataease
Name of the Vulnerable Software and Affected Versions: Dataease version 1.11.1 Description: An issue in the component "/api/plugin/upload" of Dataease allows attackers to execute arbitrary code via a crafted plugin. Recommendations: For Dataease version 1.11.1, update to version 1.11.2 to resolve...
DataEase 安全漏洞
DataEase is an open source data visualization and analysis tool. Used to help users quickly analyze data and insight into business trends , so as to achieve business improvement and optimization . DataEase v1.11.1 There is a security vulnerability , the vulnerability stems from the plug-in...