CVE-2023-4616: Improper Limitation of a Pathname to a Restricted Directory

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The issue results from the lack of proper validati...

Fedora: Security Advisory for ImageMagick (FEDORA-2023-edbdccae2a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-36674

A flaw was found in MediaWiki. When manually setting a thumbnail image for an image embed, the thumbnail image is not checked against the bad file list, allowing it to be embedded...

PT-2023-11668 · Freeimage +1 · Freeimage +1

Name of the Vulnerable Software and Affected Versions: FreeImage version 3.19.0 Description: The issue allows remote attackers to run arbitrary code via the opening of a crafted psd file. This is due to a Buffer Overflow vulnerability in the psdThumbnail::Read function in PSDParser.cpp...

WordPress Embed Video Thumbnail Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Embed Video Thumbnail Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 8566e0ea18cd Credits Rafie Muhammad Patchstack...

WordPress Video Embed & Thumbnail Generator Plugin < 4.8.11 is vulnerable to Cross Site Scripting (XSS)

Software Video Embed & Thumbnail Generator Type Plugin Vulnerable versions 4.8.11 Fixed in 4.8.11 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 593159c2fc96 Credits Rafie Muhammad...

USN-6200-1 imagemagick vulnerabilities

It was discovered that ImageMagick incorrectly handled the "-authenticate" option for password-protected PDF files. An attacker could possibly use this issue to inject additional shell commands and perform arbitrary code execution. This issue only affected Ubuntu 20.04 LTS. CVE-2020-29599 It was...

CVE-2021-4384

The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the loadimagesthumbnail and editgallery functions. This makes it possible for unauthenticat...

CVE-2023-1722

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

CVE-2023-1721

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

CVE-2023-1721

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

CVE-2023-1722: Cross-Site Request Forgery (CSRF)

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

CVE-2023-1721

The CVE-2023-1721 entry concerns Yoga Class Registration System v1.0 where an administrator can execute commands on the server due to improper validation of class thumbnails during upload. The related documents repeatedly describe a file-upload vulnerability that, enabled by admin privileges, all...

Yoga Class Registration System 跨站请求伪造漏洞

Yoga Class Registration System is a yoga class registration system by Carlo Montero Personal Developer. A cross-site request forgery vulnerability exists in Yoga Class Registration System version 1.0, which stems from the application failing to properly validate class thumbnails uploaded by an...

CVE-2023-1721: Unrestricted Upload of File with Dangerous Type

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

PT-2023-17190 · Unknown · Yoga Class Registration System

Name of the Vulnerable Software and Affected Versions: Yoga Class Registration System version 1.0 Description: The issue allows an administrator to execute commands on the server due to the application's failure to correctly validate the thumbnails of the classes uploaded by the administrators...

[SECURITY] Fedora 38 Update: ImageMagick-7.1.1.11-1.fc38

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...

CVE-2014-125102 Bestwebsoft Relevant Plugin Thumbnail information disclosure

A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability is an unknown functionality of the component Thumbnail Handler. The manipulation leads to information disclosure. The attack can be launched remotely...

PT-2023-10170 · Bestwebsoft · Bestwebsoft Relevant Plugin

Name of the Vulnerable Software and Affected Versions: Bestwebsoft Relevant Plugin versions up to 1.0.7 Description: A vulnerability was found in the Thumbnail Handler component of the Bestwebsoft Relevant Plugin, leading to information disclosure. The attack can be launched remotely...

WordPress Plugin Bestwebsoft Relevant 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An information disclosure vulnerability...