16098 matches found
Design/Logic Flaw
The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE...
CVE-2022-2268 WP All Import < 3.6.8 - Admin+ Arbitrary File Upload
The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE...
CVE-2022-2268
CVE-2022-2268 concerns the WordPress plugin “Import any XML or CSV File to WordPress” (versions before 3.6.8). The vulnerability arises because the plugin accepts all ZIP files and automatically extracts them without validating the extracted file type, enabling high-privilege users (e.g., admins)...
Important: Red Hat Security Advisory: rh-php73-php security and bug fix update
An update for rh-php73-php is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
CVE-2022-2268: Unrestricted Upload of File with Dangerous Type
The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE...
RHEL 7 : rh-php73-php (RHSA-2022:5491)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5491 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: password of excessive length...
php:7.4 security update
php 7.4.19-3 - fix password of excessive length triggers buffer overflow leading to RCE CVE-2022-31626...
php:8.0 security update
php 8.0.13-3 - fix password of excessive length triggers buffer overflow leading to RCE CVE-2022-31626...
CVE-2022-32420
CVE-2022-32420 affects College Management System v1.0, with a remote code execution (RCE) vulnerability exploitable via /College/admin/teacher.php and a crafted PHP file. Multiple connected sources corroborate an RCE condition, with CPAI-2022-0895 describing an arbitrary file upload that can lead...
CVE-2022-32420
College Management System v1.0 was discovered to contain a remote code execution RCE vulnerability via /College/admin/teacher.php. This vulnerability is exploited via a crafted PHP file...
CVE-2022-31605
NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module where YAML files are loaded with yaml.load() instead of yaml.safe_load(). This deserialization of untrusted data may allow an unauthenticated network attacker to cause Remote Code Execution, Denial of Service, and impa...
PHP Library Remote Code Execution
JAHx221 - RCE in copy/pasted PHP compat libraries, jsondecode function =============================================================================== Several PHP compatability libraries contain a potential remote code execution flaw in their jsondecode function based on having copy pasted existi...
WP All Import < 3.6.8 - Admin+ Arbitrary File Upload
The plugin accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE PoC As an admin upload a php file containing the palyload zipped along with a valid...
PT-2022-3333
Name of the Vulnerable Software and Affected Versions NVIDIA DGX A100 affected versions not specified Description The issue is related to a buffer overflow in the SBIOS component of the BiosCfgTool in NVIDIA DGX A100 servers. This can allow an attacker to execute arbitrary code, escalate...
RHEL 8 : php:7.4 (RHSA-2022:5471)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5471 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: password of excessive length triggers buff...
WordPress Elementor Page Builder Plugin 3.6.0 - 3.6.2 RCE Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elementor:websitebuilder"; ifdescription...
Important: Red Hat Security Advisory: php:8.0 security update
An update for the php:8.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Important: Red Hat Security Advisory: php:7.4 security update
An update for the php:7.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Important: Red Hat Security Advisory: php:7.4 security update
An update for the php:7.4 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
