WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE

Description The plugin accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code...

WordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.1.0 is vulnerable to SQL Injection

Software Recipe Maker For Your Food Blog from Zip Recipes Type Plugin Vulnerable versions = 8.1.0 Fixed in 8.1.1 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-52180 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 015c5c5b9e32 Credits Muhammad Daffa...

The vulnerability of the programming software for PLCs (programmable logic controllers), namely the Saia PG5 Controls Suite, arises from incorrect restrictions on the path name to the restricted access directory. This vulnerability allows a perpetrator to execute arbitrary code.

The vulnerability of the programming software for PLCs programmable logic controllers, Saia PG5 Controls Suite, is related to an incorrect limitation on the path name to the restricted access directory during the processing of ZIP format files. Exploiting this vulnerability can allow a perpetrato...

CVE-2023-6114

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the backups-dup-lite/tmp directory or the backups-dup-pro/tmp directory in the Pro version, which temporarily stores files containing sensitive data. When directory listing is...

Exploit for Insufficient Verification of Data Authenticity in Rarlab Winrar

winDED Custom exploit for CVE-2023-38831 using python. Int...

The vulnerability of the UnZip file archiver, related to pointer swapping errors, allows a hacker to trigger a service failure.

The vulnerability of the UnZip file archiver is related to errors in pointer manipulation due to improper handling of Unicode strings. Exploiting this vulnerability can allow an attacker to trigger a service failure using a specially created zip file...

VulnCheck KEV: CVE-2021-24284

The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fontsicon directory with no checks for malicious files such as PHP...

Prototype Pollution

Overview lodash is a modern JavaScript utility library delivering modularity, performance, & extras. Affected versions of this package are vulnerable to Prototype Pollution through the zipObjectDeep function due to improper user input sanitization in the baseZipObject function. PoC...

Prototype Pollution

Overview lodash.zipobjectdeep is a The lodash method .zipObjectDeep exported as a module. Affected versions of this package are vulnerable to Prototype Pollution through the zipObjectDeep function due to improper user input sanitization in the baseZipObject function. Note lodash.setwith is not...

UAC-0099 Using WinRAR Exploit to Target Ukrainian Firms with LONEPAGE Malware

The threat actor known as UAC-0099 has been linked to continued attacks aimed at Ukraine, some of which leverage a high-severity flaw in the WinRAR software to deliver a malware strain called LONEPAGE. "The threat actor targets Ukrainian employees working for companies outside of Ukraine,"...

Apache Superset Denial of Service Vulnerability

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A denial of service vulnerability exists in Apache Superset, which can be exploited by an authenticated attacker to upload a malicious ZIP for importing databases, dashboards, or datasets,...

Denial Of Service (DoS)

apachesuperset is vulnerable to Denial Of Service. The vulnerability is caused by a lack size checks for each file within a ZIP archive. This allows an attacker to upload a maliciously crafted ZIP file such as a ZIP bomb or an oversized file, and upon decompression. This flaw can result in...

(0Day) Honeywell Saia PG5 Controls Suite Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2023-38126

Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is required to exploit this vulnerability. The specific fl...

CVE-2023-38126

Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is required to exploit this vulnerability. The specific fl...

CVE-2023-38126

Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is required to exploit this vulnerability. The specific fl...

Remote code execution

Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is required to exploit this vulnerability. The specific fl...

CVE-2023-38126 Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability

Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is required to exploit this vulnerability. The specific fl...

Apache Superset uncontrolled resource consumption

Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1...

GHSA-95MG-JGFX-54V9 Apache Superset uncontrolled resource consumption

Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1...