Discord ProBot Code Issue Vulnerability

Discord is a free chat service from Discord Inc. A code issue vulnerability exists in versions prior to Discord ProBot 2021-02-08, which stems from the server's requirement that uploaded images be in text/html format, and can be exploited by an attacker to interfere with a user's image uploading...

DEBIAN-CVE-2021-21290

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's...

Pryaniki Cross-Site Scripting Vulnerability

Pryaniki is a website building system for building a corporate communication platform from the Russian company Pryaniky. The platform is used for organizing communication within the company, motivational planning, idea management projects and other business processes. Pryaniki 6.44.3 suffers from...

Squaredup 跨站脚本漏洞

Squaredup is a web service from Squaredup UK that provides data monitoring capabilities for cloud environments. A cross-site scripting vulnerability exists in SquaredUp versions prior to 4.6.0, which can be exploited by a user to create a dashboard, execute malicious content in an iframe, or uplo...

PT-2021-12848 · Squaredup · Squaredup

Name of the Vulnerable Software and Affected Versions: SquaredUp versions prior to 4.6.0 Description: The issue allows for a potential CSRF attack, where an administrator could execute arbitrary code in a HTML dashboard tile via a crafted HTML page, or by uploading a malicious SVG payload into a...

RZK Fortilogger Code Issue Vulnerability

RZK Fortilogger is a system from RZK Turkey that provides instant status tracking, logging, searching/filtering, reporting, and hotspotting for the FortiGate firewall on Windows systems. A security vulnerability exists in FortiLogger 4.4.2.2, which originates from being affected by arbitrary file...

Mozilla Firefox Type Obfuscation Code Execution Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A type confusion vulnerability exists in Mozilla Firefox when using the logical assignment operator, which prevents users from uploading files. No details of the vulnerability are provided at this time...

CVE-2021-22697

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software V2.1.13 and prior that could allow a use-after-free condition which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A type confusion vulnerability exists in Mozilla Firefox when using the logical assignment operator, which prevents users from uploading files. No details of the vulnerability are provided at this time...

Drupal 7.x, 8.x, 9.x Archive_Tar library Vulnerability (SA-CORE-2021-001) - Windows

Drupal is prone to a vulnerability in the ArchiveTar library. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Drupal 7.x, 8.x, 9.x Archive_Tar library Vulnerability (SA-CORE-2021-001) - Linux

Drupal is prone to a vulnerability in the ArchiveTar library. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

DRUPAL-CORE-2021-001

The Drupal project uses the pear Archive\Tar library, which has released a security update that impacts Drupal. For more information please see: CVE-2020-36193 Exploits may be possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them...

Drupal core - Critical - Third-party libraries - SA-CORE-2021-001

The Drupal project uses the pear ArchiveTar library, which has released a security update that impacts Drupal. For more information please see: CVE-2020-36193 Exploits may be possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them...

Wordpress contact-form-7 code issue vulnerability

Wordpress contact-form-7 is a Wordpress Foundation plugin that provides forms for Wordpress. A security vulnerability exists in contact-form-7 aka Contact Form 7 plugin prior to version 5.3.2 that allows unrestricted file uploads and remote code execution because file names may contain special...

PT-2021-11668 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server and Data Center versions prior to 7.2.0 Description: The issue allows remote attackers to impact the application's availability via a Denial of Service DoS vulnerability in the avatar upload feature. Recommendation...

Theonedev Onedev Code Issue Vulnerability

Theonedev Onedev is a JAVA-based all-in-one DevOps platform from the Theonedev team. The platform supports container build, orchestration, CI, Git management, team collaboration and other features to help developers build a simple, powerful development platform. Theonedev A code issue vulnerabili...

golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS

A flaw was found in the Go standard library packages before upstream versions 1.15 and 1.14.8. Both the net/http/cgi and net/http/fcgi packages use a default Content-Type response header value of "text/html", rather than "text/plain". This flaw allows an attacker to exploit this issue in...

Nagios XI 操作系统命令注入漏洞

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A remote code execution vulnerability exists in the "Manage Plugins" page in Nagios XI versions prior to 5.8.0. The vulnerability stem...

Open-xchange OX App Suite 跨站脚本漏洞

OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A cross-site scripting vulnerability exists in OX App Suite 7.10.4. An attacker can exploit this vulnerability via a specially crafted Content-Disposition header ...

CVE-2020-23960

Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to 1 approve the mass of the user's comments, 2 restoring a deleted user, 3 installing or running modules, 4 resetting the...