How to manually upload Telemetry data to CIS

This article explains the steps required when manually uploading the Telemetry data to CIS. Prerequisites V11.17.2 build 40000 license server or newer You must disable the automatic data upload before choosing to upload manually. Perform the following steps on your IT-managed/on-prem license serv...

Canteen Management System 代码问题漏洞

Canteen Management System is a cafeteria management system by Mayuri K. Individual developer. Canteen Management System version 1.0 has a code issue vulnerability that originates from /youthappam/phpaction/editProductImage.php which is vulnerable to arbitrary file uploads...

CVE-2022-39367 Vulnerability in handling of uploaded QTI ZIP files

QTIWorks is a software suite for standards-based assessment delivery. Prior to version 1.0-beta15, the QTIWorks Engine allows users to upload QTI content packages as ZIP files. The ZIP handling code does not sufficiently check the paths of files contained within ZIP files, so can insert files int...

PT-2022-24915 · Unknown · Gin-Vue-Admin

Name of the Vulnerable Software and Affected Versions: Gin-vue-admin versions prior to 2.5.4 Description: Gin-vue-admin is a backstage management system based on vue and gin. The system is vulnerable to path traversal, which leads to file upload vulnerabilities. This vulnerability allows maliciou...

Badaso 代码问题漏洞

Badaso is an open source Laravel Vue headless CMS from Uasoft Open Source. A security vulnerability exists in Badaso version 2.6.0 that stems from the application not properly validating user uploaded data, allowing an unauthenticated remote attacker to remotely execute arbitrary code on the serv...

Backdoor.Win32.Delf.arh MVID-2022-0650 Authentication Bypass

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/b3b19524967d22d6eb7517b03b660b00.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Delf.arh Vulnerability: Authentication Bypass Description: The malware runs...

Simple Exam Reviewer Management System 代码问题漏洞

Simple Exam Reviewer Management System is a Simple Exam Reviewer Management System by Carlo Montero Personal Developer. A security vulnerability exists in Simple Exam Reviewer Management System that originates from vulnerability to unsecured file uploads...

CVE-2022-3126

The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to make logged in users upload files on their behalf...

CVE-2022-42029

Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web directory...

PT-2022-26210 · Chamilo · Chamilo

Name of the Vulnerable Software and Affected Versions: Chamilo version 1.11.16 Description: The issue allows authenticated users with access to 'big file uploads' to copy or move files from anywhere in the file system into the web directory. This is due to an authenticated local file inclusion...

Simple Cold Storage Management System 代码问题漏洞

Simple Cold Storage Management System is a Simple Cold Storage Management System by Carlo Montero Personal Developer. A security vulnerability exists in Simple Cold Storage Management System version 1.0, which stems from the lack of restriction on user uploads...

CVE-2022-42029

Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web directory...

Gin-Vue-Admin 代码问题漏洞

Gin-Vue-Admin is a full-stack pre-development infrastructure platform based on Vue and Gin development. A code issue vulnerability exists in Gin-Vue-Admin versions v2.5.1 through v2.5.3b, which stems from not restricting file upload functionality. An attacker exploiting this vulnerability could...

BoxBilling 代码问题漏洞

BoxBilling is open source billing and customer management software from the individual developers of BoxBilling. A security vulnerability exists in BoxBilling versions prior to 0.0.1 that stems from not restricting the upload of dangerous types of files...

WordPress plugin Profile Builder 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

Amazon Linux AMI : libapreq2 (ALAS-2022-1637)

The version of libapreq2 installed on the remote host is prior to 2.13-38.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1637 advisory. A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A...

netty: world readable temporary file containing sensitive data

CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled...

keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console

A flaw was found in keycloak. The vulnerability allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOADSCRIPTS feature is disabled...

UBUNTU-CVE-2022-3125

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and achieve RCE...

UBUNTU-CVE-2022-3124

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server...