8699 matches found
[SECURITY] [DLA 4360-1] pure-ftpd security update
Debian LTS Advisory DLA-4360-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincón November 03, 2025 https://wiki.debian.org/LTS Package : pure-ftpd Version : 1.0.49-4.1+deb11u1 CVE ID : CVE-2021-40524 Debian Bug : 993810 It was discovered that pure-ftpd, a secu...
Debian dla-4360 : pure-ftpd - security update
The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4360 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4360-1 [email protected] https://www.debian.org/lts/security/...
EUVD-2025-37426
The RESTful Content Syndication plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ingestimage function in versions 1.1.0 to 1.5.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary file...
WordPress plugin Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 代码问题漏洞
WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. WordPress plugin...
WordPress plugin WP Delicious – Recipe Plugin for Food Bloggers 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code issue...
PT-2025-44718
Name of the Vulnerable Software and Affected Versions WordPress RESTful Content Syndication plugin versions 1.1.0 through 1.5.0 Description The RESTful Content Syndication plugin for WordPress is affected by a flaw that allows authenticated attackers with Author-level access or higher to upload...
CVE-2020-36863
Nagios XI versions prior to 5.7.2 allow PHP files to be uploaded to the Audio Import directory and executed from that location. The upload handler did not properly restrict file types or enforce storage outside of the webroot, and the web server permitted execution within the upload directory. An...
CVE-2025-10348
URVE Smart Office is vulnerable to Stored XSS in report problem functionality. An attacker with a low-privileged account can upload an SVG file containing a malicious payload, which will be executed when a victim visits the URL of the uploaded resource. The resource is available to anyone without...
ELog 安全漏洞
ELog is an electronic logging software with a web interface by the individual developer Stefan Ritt. A security vulnerability exists in ELog versions 3.1.5 through 20251014, which stems from allowing authenticated users to upload arbitrary HTML files, potentially leading to cross-site scripting...
PT-2025-44469
Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.7.2 Description Nagios XI versions prior to 5.7.2 permit the upload and execution of PHP files within the Audio Import directory. The upload process does not adequately restrict file types or ensure storage outsid...
EUVD-2025-36564
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite...
EUVD-2025-36566
DNN CKEditor Provider allows unauthenticated upload out-of-the-box...
GHSA-2374-6CVW-QMX6 DNN CKEditor Provider allows unauthenticated upload out-of-the-box
Summary The out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. Details The new out-of-box experience blocks that endpoint to unauthenticated users. If there is a rea...
DNN CKEditor Provider allows unauthenticated upload out-of-the-box
Summary The out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. Details The new out-of-box experience blocks that endpoint to unauthenticated users. If there is a rea...
CVE-2025-10932
CVE-2025-10932 is an Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module). The issue affects MOVEit Transfer versions 2025.0.0–before 2025.0.3, 2024.1.0–before 2024.1.7, and 2023.1.0–before 2023.1.16. The root cause is an input/AS2 request handling flaw that ca...
CVE-2025-10932 AS2 module allows uncontrolled file uploads
Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer AS2 module.This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16...
CVE-2025-10932 AS2 module allows uncontrolled file uploads
Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer AS2 module.This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16...
CVE-2025-12346
A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/autopost/uploads-require-maxsite.php of the component HTTP Header Handler. Performing manipulation of the argument X-Requested-FileName/X-Requested-FileUpDi...
SUSE CVE-2025-61795
Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred including exceeding limits during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to...
Aviatrix Controller Unrestricted Upload of File (CVE-2021-40870)
While the Aviatrix UI requires authentication, many API calls do not enforce a check for authentication. Some of these API calls allow an unauthenticated attacker to upload arbitrary files, including .php scripts, to the filesystem. These uploaded scripts will be processed by the web frontend,...