Nextcloud: Error in Deleting Deck cards attachment reveals the full path of the website

Summary: An error in deck cards when deleting an attachment reveals the full path of the website. DELETE /apps/deck/cards/11/attachment/file:1 HTTP/2 Host: ctulhu.me/nc Sec-Ch-Ua: "Chromium";v="93", " Not;A Brand";v="99" Accept: application/json, text/plain, / Sec-Ch-Ua-Mobile: ?0 User-Agent:...

CVE-2020-20124

Wuzhi CMS v4.1.0 contains a remote code execution RCE vulnerability in \attachment\admin\index.php...

CVE-2020-20124

Wuzhi CMS v4.1.0 contains a remote code execution RCE vulnerability in \attachment\admin\index.php...

Remote code execution

Wuzhi CMS v4.1.0 contains a remote code execution RCE vulnerability in \attachment\admin\index.php...

CVE-2020-20124

Wuzhi CMS v4.1.0 contains a remote code execution RCE vulnerability in \attachment\admin\index.php...

CVE-2021-22950

Concrete CMS prior to version 8.5.6 has a cross-site request forgery (CSRF) vulnerability that allows deletion of attachments in the conversation section comments. The issue is documented across multiple feeds (CVE-2021-22950) with an NVD CVSS 3.1 base score of 6.5 (Network, Low attack complexity...

Apple iPadOS 缓冲区错误漏洞

Apple iPadOS is a suite of operating systems from Apple Inc. for the iPad tablet computer. Apple iPadOS suffers from a buffer error vulnerability that originates from a boundary error in the Attachment Manager. An attacker can exploit the vulnerability to trigger excessive memory consumption and...

Apple iOS和Apple iPadOS 缓冲区错误漏洞

Apple iOS and Apple iPadOS are products of Apple Inc.Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for iPad tablets.Apple iOS 15 and iPadOS 15 have a buffer error vulnerability that originates from a boundary error in the attachment manager. A...

CVE-2021-3709

Function checkattachmentforerrors in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to...

CVE-2021-39195

Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been...

Server side request forgery (ssrf)

Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been...

The vulnerability of the Thunderbird email client arises from insufficient validation of input data, allowing a hacker to insert any desired name as an attachment.

The vulnerability of the Thunderbird email client exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to inject any desired name into the attachment’s filename...

couchdb -- user privilege escalation

Cory Sabol reports: A malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will ...

Cybozu Garoon Attaching Files Incorrectly Entered Validation Vulnerability

A security vulnerability exists in Attaching Files in Cybozu Garoon, a portal-based OA office system from Cybozu Japan. An attacker could use this vulnerability to obtain data from the attached files...

UBUNTU-CVE-2021-25803

A buffer overflow vulnerability in the vlcinputattachmentNew component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file...

VideoLAN VLC Media Player 输入验证错误漏洞

VideoLAN VLC is an open source cross-platform multimedia player and framework for playing most multimedia files, as well as DVDs, audio CDs, VCDs and various streaming protocols. vlcinputattachmentNew component in VideoLAN VLC version 3.0.11 is vulnerable to buffer overflow, which can be exploite...

Remcos RAT delivered via Visual Basic

This blog post was authored by Erika Noerenberg Introduction Over the past months, Malwarebytes researchers have been tracking a unique malspam campaign delivering the Remcos remote access trojan RAT via financially-themed emails. Remcos is often delivered via malicious documents or archive files...

Experts Uncover Malware Attacks Targeting Corporate Networks in Latin America

Cybersecurity researchers on Thursday took the wraps off a new, ongoing espionage campaign targeting corporate networks in Spanish-speaking countries, specifically Venezuela, to spy on its victims. Dubbed "Bandidos" by ESET owing to the use of an upgraded variant of Bandook malware, the primary...

Samsung Tizen 输入验证错误漏洞

Samsung Tizen is an open source Linux kernel-based mobile operating system from South Korea's Samsung, available for devices including smartphones, tablets, smartwatches, netbooks, in-vehicle messaging and entertainment devices, and smart TVs. The input validation error vulnerability exists in...

Advisory ROSA-SA-2021-1808

Software: binutils 2.27 OS: Cobalt 7.9 CVE-ID: CVE-2017-12448 CVE-Crit: HIGH CVE-DESC: The bfdcacheclose function in bfd / cache.c in the Binary File Descriptor BFD library also known as libbfd distributed in GNU Binutils 2.29 and earlier allows remote attackers to invoke heap usage upon release...