CVE-2022-23100

OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter e.g., through an email attachment...

CVE-2022-23100

CVE-2022-23100 affects Open-Xchange OX App Suite up to version 7.10.6, where the vulnerability exists in the Documentconverter component allowing OS command injection. An authenticated OX App Suite user can trigger a document conversion (e.g., via an email attachment or OX Drive content) and exec...

CVE-2022-23100

OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter e.g., through an email attachment...

CVE-2022-34551

Sims v1.0 was discovered to allow path traversal when downloading attachments...

PT-2022-22202 · Sims · Sims

Name of the Vulnerable Software and Affected Versions: Sims version 1.0 Description: The issue allows path traversal when downloading attachments. Recommendations: For Sims version 1.0, consider restricting access to attachment downloads until a patch is available...

Cross-Site Scripting (XSS)

Best Practical Request Tracker is vulnerable to cross-site scripting. The vulnerability exists via a crafted content type for an attachment which allows an attacker to inject and execute arbitrary javascript...

CVE-2022-29454 WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WordPlus Better Messages plugin = 1.9.9.148 at WordPress allows attackers to upload files. File attachment to messages must be activated...

CVE-2022-25802

Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...

DEBIAN-CVE-2022-25802

Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...

Design/Logic Flaw

Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...

CVE-2022-25802

Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...

UBUNTU-CVE-2022-25802

Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...

CVE-2022-25802

Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...

CVE-2022-25802

Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...

CVE-2022-25802

Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...

CVE-2022-25802

Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...

Best Practical Request Tracker 跨站脚本漏洞

Best Practical Request Tracker is an event tracking system written in Perl. A cross-site scripting vulnerability exists in Best Practical Request Tracker. An attacker could use this vulnerability to trigger cross-site scripting in Request Tracker via the attachment content type, which could be us...

PT-2022-3609 · Unknown +2 · Request Tracker +2

Name of the Vulnerable Software and Affected Versions: Request Tracker versions prior to 4.4.6 Request Tracker versions 5.x prior to 5.0.3 Description: The issue allows for a cross-site scripting XSS attack via a crafted content type for an attachment. This can be exploited by a remote attacker t...

Design/Logic Flaw

Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only accessible to administrators, in many...

PT-2022-3931 · Sap · Sap Successfactors +1

Name of the Vulnerable Software and Affected Versions: SAP SuccessFactors affected versions not specified Description: The issue is related to misconfigured application endpoints in SAP SuccessFactors attachment APIs, allowing attackers with user privileges to perform activities with admin...