1639 matches found
CloudBees Jenkins Avatar Plugin Authorization Issue Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . An authorization issue vulnerability exists in CloudBees Jenkins Avatar Plugin. An attacker can exploit this vulnerability to perform modification operations on...
Mail.ru: Avatar upload allows arbitrary file overwriting
Directory traversal via filename extension for avatar upload allowed to overwrite arbitrary files in S3-compatible bucket for static files in pandao.ru. Pandao.ru belongs to extended scope...
CVE-2019-10377
A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins...
CVE-2019-10377
A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins...
Information disclosure
A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins...
CVE-2019-10377
A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins...
CVE-2019-10377
CVE-2019-10377 affects Jenkins Avatar Plugin versions 1.2 and earlier. The root cause is a missing permission check, which allows attackers with Overall/Read access to change the avatar of any Jenkins user. The consequence is unauthorized modification of user avatars, under the stated access leve...
PT-2019-11773 · Jenkins · Jenkins Avatar Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Avatar Plugin versions 1.2 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read access to change the avatar of any user of Jenkins. Recommendations: For Jenkins Avatar Plugin versions 1....
Hiro: EXIF Geolocation Data Not Stripped From Uploaded Images
The Blockstack Browser does not strip EXIF data on avatar uploads...
PHP-Fusion 9.03.00 Remote Code Execution Exploit
This Metasploit module exploits a command execution vulnerability in PHP-Fusion versions 9.03.00 and below. It is possible to execute commands in the system with ordinary user authority. This module requires Metasploit: https://metasploit.com/download Current source:...
CVE-2019-12099
In PHP-Fusion 9.03.00, editprofile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/formfileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload...
CVE-2019-12099
In PHP-Fusion 9.03.00, editprofile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/formfileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload...
Code injection
In PHP-Fusion 9.03.00, editprofile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/formfileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload...
CVE-2019-12099
In PHP-Fusion 9.03.00, editprofile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/formfileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload...
CVE-2019-12099
CVE-2019-12099 affects PHP-Fusion 9.03.00. The vulnerability is in edit_profile.php where remote authenticated users can execute arbitrary code due to mishandling of executable files during avatar uploads in includes/dynamics/includes/form_fileinput.php and includes/classes/PHPFusion/Installer/Li...
PHP-Fusion 9.03.00 Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "PHP-Fusion %q This module exploits command execution vulnerability in PHP-Fusion 9.03.00 and prior versions. It is possible to execute commands i...
PHP-Fusion 9.03.00 - Edit Profile Remote Code Execution (Metasploit)
PHP-Fusion 9.03.00 - Edit Profile Remote Code Execution Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "PHP-Fusion %q This module exploits command execution vulnerability in PHP-Fusi...
Server-Side Request Forgery (SSRF)
phpbb/phpbb is vulnerable to server-side request forgery SSRF. A remote attacker is able to send requests on behalf of the server via the remote avatar upload function. This allows for the discovery of and access to services running on the host, resulting in bypass of firewall rules or potentiall...
UBUNTU-CVE-2019-11767
Server side request forgery SSRF in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function...
Server side request forgery (ssrf)
Server side request forgery SSRF in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function...