714 matches found
CVE-2020-26596
The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO...
CVE-2020-26596: Improper Privilege Management
The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO...
PT-2020-16469
Name of the Vulnerable Software and Affected Versions Elementor Pro plugin versions through 3.0.5 Description The issue allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. Recommendations For...
Open-Xchange: SSRF - Unchecked Snippet IDs for distributed files
ManagedFile ManagedFiles are basically just temporary files with some ID used for various purposes. When a managed file is created, it is registered in the local file map, which is just an internal map from StringUUID to ManagedFile, and optionally also in the distributed file map, which is a...
Cross-site Scripting (XSS)
Activity Stream is vulnerable to cross-site scripting XSS. It can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Strea...
The vulnerability of the ext/fts3/fts3_snippet.c component of the SQLite database management system, which allows a hacker to cause a service failure.
The vulnerability of the ext/fts3/fts3snippet.c component of the SQLite database management system is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...
OX App Suite Access Control Bypass Vulnerability
Open-Xchange OX App Suite is a modular platform designed for telcos, hosting companies and vendors to provide a wide range of cloud-based services. An access control bypass vulnerability exists in OX App Suite 7.10.3 and earlier versions. The vulnerability stems from an incorrect permission check...
CVE-2020-12643
OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address...
The vulnerability of the Zoom video conferencing service arises from an incorrect path name limitation for accessing the restricted catalog, allowing a violator to execute arbitrary code.
The vulnerability of the Zoom video conferencing service exists due to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created message a “snippet” with the code...
Zoom Client Application Chat Code Snippet Remote Code Execution Vulnerability
Summary An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacke...
SQLite Resource Management Error Vulnerability (CNVD-2020-31117)
SQLite is the United States D. Richard Hipp software developers of a set of C-based open source embedded relational database management system. The system is characterized by independence, isolation, cross-platform and so on. A resource management error vulnerability exists in the 'snippet'...
DEBIAN-CVE-2020-13630
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature...
AZL-38146 CVE-2020-13630 affecting package ceph for versions less than 18.2.1-1
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature...
UBUNTU-CVE-2020-13632
ext/fts3/fts3snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo query...
UBUNTU-CVE-2020-13630
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature...
Design/Logic Flaw
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature...
CVE-2020-13630
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature...
CVE-2020-13630
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature...
