CVE-2021-45808

jpress v4.2.0 allows users to register an account by default. With the account, user can upload arbitrary files to the server...

CVE-2021-45808

jpress v4.2.0 allows users to register an account by default. With the account, user can upload arbitrary files to the server...

CVE-2021-45808

jpress v4.2.0 allows users to register an account by default. With the account, user can upload arbitrary files to the server...

CVE-2021-45808

CVE-2021-45808 affects Jpress v4.2.0. Connected sources describe a file-upload vulnerability enabled by default account registration, allowing upload of arbitrary files to the server and potential remote code execution. No explicit remediation or patch details are provided in the supplied documen...

CVE-2021-45807

jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin.AddonController::doUploadAndInstall...

CVE-2021-45807

jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin.AddonController::doUploadAndInstall...

CVE-2021-45807

jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin.AddonController::doUploadAndInstall...

CVE-2021-45806

jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code...

CVE-2021-45806

jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code...

CVE-2021-45806

CVE-2021-45806 affects jpress v4.2.0: the admin panel exposes a function that allows attackers to modify templates and inject malicious code. The reported impact is malicious code injection via template modification, but the provided documents do not specify the exact root cause, vulnerable compo...

CVE-2021-45806

jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code...

Security fix for the ALT Linux 10 package libtiff version 4.2.0-alt1

Dec. 25, 2020 Vladimir D. Seleznev 4.2.0-alt1 - Updated to v4.2.0 fixed CVE-2020-35521, CVE-2020-35522, CVE-2020-35523 and CVE-2020-35524...

Privilege escalation

nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentication/Configure because it is possible to upload a crafted Facebook Auth plugin...

CVE-2019-19684

CVE-2019-19684 affects nopCommerce v4.2.0, enabling privilege escalation via file upload through Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs (Admin/FacebookAuthentication/Configure) by uploading a crafted Facebook Auth plugin. Root cause: insecure file upload in the PluginCon...

CVE-2019-19684

nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentication/Configure because it is possible to upload a crafted Facebook Auth plugin...

CVE-2019-19683

CVE-2019-19683 affects nopCommerce v4.2.0 when using RoxyFileman. The issue is a path traversal vulnerability: an attacker can exploit ../ traversal via d or f to reach Admin/RoxyFileman/ProcessRequest due to the implementation in Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs...

WiKID Systems 2FA Enterprise Server 4.2.0-b2032 SQL Injection / XSS / CSRF

WiKID Systems 2FA Enterprise Serverversion 4.2.0-b2032 and earlier was found to be vulnerable to multiple Cross-Site Scripting, SQLi, and CSRF issues. searchDevices.jsp is vulnerable to SQL injection through the uid and domain parameters. The application uses Postgres which supports Stacked...

PHPNuke-Clan <= 4.2.0 - (mvcw_conver.php) RFI Vulnerability

No description provided by source. '/ -.- --------------------------oOO------OOo------------------------- | PHPNuke-Clan = v4.2.0 mvcwconver.php Remote File Inclusion | | coded by DNX | ------------------------------------------------------------------ ! Discovered: DNX ! Vendor:...