43 matches found
CVE-2025-0476 Mobile crash via file with specially crafted filename
Mattermost Mobile Apps versions =2.22.0 fail to properly handle specially crafted attachment names, which allows an attacker to crash the mobile app for any user who opened a channel containing the specially crafted attachment...
PT-2025-3908 · Mattermost · Mattermost Mobile Apps
Name of the Vulnerable Software and Affected Versions: Mattermost Mobile Apps versions =2.22.0 Description: The issue arises from the mobile application's inability to properly handle specially crafted attachment names. This allows an attacker to crash the mobile app for any user who has opened a...
Mattermost Mobile Apps 安全漏洞
Mattermost Mobile Apps is a messaging mobile application from Mattermost USA. A denial of service vulnerability exists in Mattermost Mobile Apps that stems from the application failing to properly handle specially crafted attachment names. An attacker could use this vulnerability to cause the...
CVE-2023-28485
A stored cross-site scripting Stored XSS vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board where they have BoardAdmin access,...
CVE-2023-28485
A stored cross-site scripting Stored XSS vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board where they have BoardAdmin access,...
Wekan 跨站脚本漏洞
WeKan is a website builder system from the Wekan team that provides the ability to make planning lists and plan time. A security vulnerability exists in WeKan versions prior to 6.75, which stems from a stored cross-site scripting XSS vulnerability in the file preview feature. An attacker could...
CVE-2023-28485
A stored cross-site scripting Stored XSS vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board where they have BoardAdmin access,...
CVE-2023-22503
Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Roj...
Information disclosure
Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Roj...
CVE-2023-22503
Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Roj...
Atlassian Confluence Server 安全漏洞
Atlassian Confluence Server is the server version of Atlassian Australia's suite of collaboration software with enterprise knowledge management features and support for building enterprise WiKi. A security vulnerability exists in Atlassian Confluence Server and Data Center. An attacker could...
PT-2023-2589 · Atlassian · Confluence
Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server versions prior to 7.13.15 Atlassian Confluence Server versions 7.14.0 through 7.19.7 Atlassian Confluence Server versions 7.20.0 through 8.2.0 Atlassian Confluence Data Center versions prior to 7.13.15 Atlassian...
MGASA-2020-0313 Updated php-phpmailer packages fix security vulnerability
Fix insufficient output escaping bug in file attachment names CVE-2020-13625...
UBUNTU-CVE-2020-13625
PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message...
GHSA-F7HX-FQXW-RVVJ Insufficient output escaping of attachment names in PHPMailer
Impact CWE-116: Incorrect output escaping. An attachment added like this note the double quote within the attachment name, which is entirely valid: $mail-addAttachment'/tmp/attachment.tmp', 'filename.html";.jpg'; Will result in a message containing these headers: Content-Type:...
Disclosure of issue key validity & issue attachment names in the render api resource - CVE-2019-14995
The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check...
Attachment name leakage from restricted space
h3. Issue Summary Hello, This issue was discovered through our bugbounty program and has been verified: User can view attachment names in a restricted space by accessing the following endpoint: noformat http://host/rest/previews/templinksresource/attachmenturl?attachmentId=id noformat h3...
Cisco Email Security Appliance Input Validation Error Vulnerability
Cisco Email Security Appliance ESA is an email security appliance from Cisco in the U.S. AsyncOS Software is the operating system that runs on it. An input validation error vulnerability exists in the scanning of attachments in the Cisco ESA, which stems from the program's failure to perform prop...
DEBIAN-CVE-2016-5833
Cross-site scripting XSS vulnerability in the columntitle function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834...
