Craft CMS 路径遍历漏洞

Craft CMS is an open-source content management system developed by Craft Studio. Versions of Craft CMS from 4.0.0-RC1 to 4.17.5, as well as 5.0.0-RC1 to 5.9.11, contained a path traversal vulnerability. This vulnerability stemmed from the targetFilename parameter in the AssetsController-replaceFi...

Design/Logic Flaw

In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated attacker to upload any file without extension filtering...

CVE-2023-29770: Unrestricted Upload of File with Dangerous Type

In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated attacker to upload any file without extension filtering...

CVE-2023-29770

In CVE-2023-29770, Sentrifugo 3.5 is affected by a vulnerability in AssetsController::uploadsaveAction that allows an authenticated attacker to upload arbitrary files without extension filtering. The issue enables unauthenticated? No—authenticated attacker per description, with impact described a...

CVE-2023-29770

In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated attacker to upload any file without extension filtering...

Improper Access Control

snipe/snipe-it is vulnerable to improper access control. The vulnerability exists in the getRequestedIndex function in AssetsController.php due to insufficient user permissions to assets index which allows unauthorized users to access the system...

Snipe-IT Cross-Site Scripting Vulnerability

Snipe-IT is an open source IT asset/license management system. Snipe-IT has a cross-site scripting vulnerability that stems from the lack of filtering and escaping of user-submitted data in AssetsController, for which no detailed vulnerability details are currently available...