WBCE CMS security vulnerability

WBCE CMS is an open source content management system CMS based on PHP and MySQL. WBCE CMS suffers from a security vulnerability that originates in /templates/install.php that allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-25176

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file typically Jenkinsfile for Pipelines, allowing attackers able to configure Pipelines to read arbitrary files on t...

Backdrop CMS Cross-Site Request Forgery Vulnerability

Backdrop CMS is an open source content management system CMS. A cross-site request forgery vulnerability exists in Backdrop CMS, which stems from obtaining remote code execution RCE on a hosted web server by uploading a malicious add-on with a crafted PHP file. No details of the vulnerability are...

CVE-2021-43519

Stack overflow in luaresume of ldo.c in Lua Interpreter 5.1.05.4.4 allows attackers to perform a Denial of Service via a crafted script file...

CVE-2021-43519

Stack overflow in luaresume of ldo.c in Lua Interpreter 5.1.05.4.4 allows attackers to perform a Denial of Service via a crafted script file...

Stack overflow

Stack overflow in luaresume of ldo.c in Lua Interpreter 5.1.05.4.4 allows attackers to perform a Denial of Service via a crafted script file...

CVE-2021-43519

Stack overflow in luaresume of ldo.c in Lua Interpreter 5.1.05.4.4 allows attackers to perform a Denial of Service via a crafted script file...

CVE-2021-43519

Stack overflow in luaresume of ldo.c in Lua Interpreter 5.1.05.4.4 allows attackers to perform a Denial of Service via a crafted script file...

Online Reviewer System Code Issues and Vulnerabilities

Online Reviewer System is a software application. An online reviewer system. A security vulnerability exists in Sourcecodester Online Reviewer System version 2.0, which allows an attacker to bypass the image upload filter and upload a maliciously crafted PHP file...

FeehiCMS code-related vulnerabilities

FeehiCMS is a Php-based CMS builder. feehiCMS v2.0.8 and previous versions have a security vulnerability that can be exploited by attackers to execute arbitrary code via a crafted PHP file...

CVE-2021-37334

Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. A vulnerability occurs because validation of the file extension is performed after the file has been stored in a...

CVE-2021-25809

UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache function in top.php...

CVE-2021-35523

Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file tha...

Design/Logic Flaw

Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file tha...

CVE-2021-35523

Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file tha...

PT-2021-20951

Name of the Vulnerable Software and Affected Versions: Securepoint SSL VPN Client versions prior to 2.0.32 Description: The issue concerns unsafe configuration handling that enables local privilege escalation to NT AUTHORITYSYSTEM. A non-privileged local user can modify the OpenVPN configuration...

CVE-2020-25010

An arbitrary code execution vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version:R0002.P05 allows remote attackers to upload a malicious script file by constructing a POST type request and writing a payload in the request parameters as an...

PT-2020-15886

Name of the Vulnerable Software and Affected Versions Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version: R0002.P05 Description The issue allows remote attackers to execute arbitrary code by uploading a malicious script file. This is achieved by constructin...

PT-2020-14334

Name of the Vulnerable Software and Affected Versions baserCMS versions 4.0.0 through 4.4.0 Description The issue allows for Remote Code Execution RCE by uploading an executable script file, such as a PHP file, after logging in as a system administrator. The Edit template component is vulnerable...

CVE-2020-6288

SAP Business Objects Business Intelligence Platform Web Intelligence HTML interface allows an attacker with edit document rights to upload any file including script files without proper file format validation leading to Unrestricted upload of file with dangerous type vulnerability. The attacker c...