CVE-2021-28379

web/upload/UploadHandler.php in Vesta Control Panel aka VestaCP through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin...

Vesta Control Panel 代码问题漏洞

Vesta Control Panel VestaCP is an open source web hosting control panel. A code issue vulnerability exists in Vesta Control Panel version 0.9.8-27 and prior versions, which stems from web upload UploadHandler.php allowing uploads from different sources...

Updated netty packages fix a security vulnerability

When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled CVE-2021-21290...

DEBIAN-CVE-2020-13936

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache...

CVE-2021-21362

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who us...

Design/Logic Flaw

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who us...

Vulnerabilities fixed in Joomla

Several vulnerabilities have been fixed in Joomla. The vulnerabilities potentially enable a malicious party to launch attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Manipulation of data Circumvention of security measure The vulnerability with...

CVE-2021-23132

An issue was discovered in Joomla! 3.0.0 through 3.9.24. commedia allowed paths that are not intended for image uploads...

CVE-2021-23132 [20210306] - Core - com_media allowed paths that are not intended for image uploads

An issue was discovered in Joomla! 3.0.0 through 3.9.24. commedia allowed paths that are not intended for image uploads...

CVE-2021-23132

The CVE-2021-23132 issue affects Joomla! core: versions 3.0.0 through 3.9.24 allow image-upload paths in com_media that were not intended, enabling access to unintended directories. Root cause: insecure handling in com_media leading to path exposure and potential exploitation. Documented impact i...

PT-2021-15387 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.24 Description: An issue was discovered in the com media component, which allowed paths that are not intended for image uploads. Recommendations: For Joomla! versions 3.0.0 through 3.9.24, consider restricti...

Exploit for CVE-2021-23132

CVE-2021-23132 commedia allowed paths that are not intended f...

The vulnerability of the installation file FortiClientEMSOnlineInstaller.exe of the Fortinet FortiClient Enterprise Management Server (EMS) allows a perpetrator to execute arbitrary code.

The vulnerability of the installation file FortiClientEMSOnlineInstaller.exe of the Fortinet FortiClient Enterprise Management Server EMS server is related to errors in the path validation mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code using specially...

CVE-2021-23956

An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. This vulnerability affects Firefox 85...

File Upload Vulnerability in dotCMS

dotCMS is a content management system CMS. A file upload vulnerability exists in dotCMS, which can be exploited by an attacker to upload arbitrary files...

PT-2021-19201 · Yith · Yith Woocommerce Gift Cards Premium

Name of the Vulnerable Software and Affected Versions: YITH WooCommerce Gift Cards Premium plugin versions prior to 3.3.1 Description: The issue allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. To exploit this, an attacker...

note-mark

Note Mark !License: AGPL V3https://img.shields.io/github/li...

CVE-2020-16144

When using an object storage like S3 as the file store, when a user creates a public link to a folder where anonymous users can upload files, and another user uploads a virus the files antivirus app would detect the virus but fails to delete it due to permission issues. This affects the...

CVE-2020-16144

When using an object storage like S3 as the file store, when a user creates a public link to a folder where anonymous users can upload files, and another user uploads a virus the files antivirus app would detect the virus but fails to delete it due to permission issues. This affects the...

Information Disclosure

netty-codec-http is vulnerable to information disclosure. When netty's multipart decoders are used, local files containing confidential information can be accessed via the local system temporary directory if temporary storing uploads on the disk is enabled...