9435 matches found
CVE-2021-45040
The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...
CVE-2021-45040
The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...
Design/Logic Flaw
The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...
CVE-2021-45040
The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...
CVE-2022-24072
The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool...
pgAdmin 4 Path Traversal vulnerability
When run in server mode, pgAdmin 4 allows users to store files on the server under individual storage directories. Files such as SQL scripts may be uploaded through the user interface. The URI to which upload requests are made fails to validate the upload path to prevent path traversal techniques...
GHSA-CR8C-972V-RMP3 pgAdmin 4 Path Traversal vulnerability
When run in server mode, pgAdmin 4 allows users to store files on the server under individual storage directories. Files such as SQL scripts may be uploaded through the user interface. The URI to which upload requests are made fails to validate the upload path to prevent path traversal techniques...
showdoc .properties file upload vulnerability (CNVD-2022-20508)
showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 are vulnerable to file uploads, which stem from the lack of effective detection of .properties file extensions in the application's file upload feature. An attacker could use this vulnerabilit...
Cross-Site Scripting (XSS)
getgrav/grav is vulnerable to stored cross-site scripting. The vulnerability exists due to lack of xss validations for uploaded SVG files before they get stored which allows an attacker to inject and execute arbitrary javascript...
Cross-site Scripting in ShowDoc
ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via uploading files with files in .xsd, .asa, and .aspx formats...
GHSA-9FCC-7G44-MXRJ Cross-site Scripting in ShowDoc
ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via uploading files with files in .xsd, .asa, and .aspx formats...
Vulnerabilities fixed in Mattermost Server
Two vulnerabilities have been fixed in Mattermost Server. A unauthenticated malicious person can exploit the vulnerabilities to cause a denial-of-service. To do so, a malicious file needs to be uploaded or a malicious POST request needs to be sent be sent to the server. For the latter, no...
showdoc .shtml file upload vulnerability
showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 are vulnerable to file uploads, which stem from the lack of effective detection of .shtml file extensions in the application's file upload feature. An attacker could use this vulnerability to...
CVE-2022-25487
Atom CMS v2.0 was discovered to contain a remote code execution RCE vulnerability via /admin/uploads.php...
CVE-2022-25487
Atom CMS v2.0 was discovered to contain a remote code execution RCE vulnerability via /admin/uploads.php...
CVE-2022-25487
Atom CMS v2.0 was discovered to contain a remote code execution RCE vulnerability via /admin/uploads.php...
PT-2022-13550 · Showdoc · Showdoc
Name of the Vulnerable Software and Affected Versions: showdoc versions prior to 2.10.4 Description: The issue concerns an unrestricted upload of files with dangerous types in the GitHub repository star7th/showdoc. This is due to the upload feature allowing files with the extension .html, which c...
PT-2022-12299
Name of the Vulnerable Software and Affected Versions Spatie media-library-pro library versions 1.17.10 and earlier Spatie media-library-pro library versions 2.x through 2.1.6 Description The issue allows remote attackers to upload executable files via the "uploads route" API endpoint. This can b...
showdoc 跨站脚本漏洞
showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 are vulnerable to file uploads, which stem from the lack of effective detection of .md file extensions in the application's file upload feature. An attacker could use this vulnerability to...