238 matches found
CVE-2022-3870
Removed by vendor...
Lensa AI and ‘Magic Avatars’: What to Know Before Using the App
Are you thinking about uploading some selfies and buying a pack of ‘Magic Avatars’? Consider these expert tips first...
ToolJet is vulnerable to Denial of Service (DoS)
ToolJet/ToolJet placed no limit on the file size for user avatars. This could cause a denial of service if too many users upload large files. This is fixed in commit 01cd3f0464747973ec329e9fb1ea12743d3235cc in version 1.27.0. tooljet is no longer listed on npmjs.com but was listed on npmjs.com in...
GHSA-HGP8-W8FJ-R4CM ToolJet is vulnerable to Denial of Service (DoS)
ToolJet/ToolJet placed no limit on the file size for user avatars. This could cause a denial of service if too many users upload large files. This is fixed in commit 01cd3f0464747973ec329e9fb1ea12743d3235cc in version 1.27.0. tooljet is no longer listed on npmjs.com but was listed on npmjs.com in...
GLPI 跨站脚本漏洞
GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...
CVE-2022-0442
CVE-2022-0442 affects the WordPress plugin UsersWP (versions prior to 1.2.3.1). The issue is a lack of access controls when updating a user avatar and non-unique avatar filenames, enabling a logged-in user to overwrite another user’s avatar. The vulnerability is confirmed across multiple sources ...
WordPress Learnpress 4.1.4.1 Plugin - Arbitrary Image Renaming Vulnerability
Exploit Title: WordPress Plugin Learnpress 4.1.4.1 - Arbitrary Image Renaming Exploit Author: Ceylan Bozogullarindan Author Webpage: https://bozogullarindan.com Vendor Homepage: https://thimpress.com/ Software Link: https://thimpress.com/learnpress-plugin/ Version: 4.1.4.1 Tested on: Linux CVE:...
Zammad Cross-Site Scripting Vulnerability (CNVD-2021-81950)
Zammad is a Web-based open source help desk/customer support system. versions prior to Zammad 4.1.1 are vulnerable to a stored cross-site scripting vulnerability. An attacker could exploit the vulnerability to inject malicious JavaScript code via a custom avatar...
Matrix Information Disclosure Vulnerability (CNVD-2021-70122)
Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. Matrix 1.41.0 and earlier versions have an information disclosure vulnerability that could be exploited by attackers to access room names, avatars, topics and member counts...
Matrix 信息泄露漏洞
Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. Matrix 1.41.0 and earlier versions have an information disclosure vulnerability that could be exploited by attackers to access room names, avatars, topics and member counts...
WordPress 插件访问控制错误漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A security vulnerability exists in versions o...
CVE-2020-4648
A vulnerability exsists in IBM Planning Analytics 2.0 whereby avatars in Planning Analytics Workspace could be modified by other users without authorization to do so. IBM X-Force ID: 186019...
Authorization
A vulnerability exsists in IBM Planning Analytics 2.0 whereby avatars in Planning Analytics Workspace could be modified by other users without authorization to do so. IBM X-Force ID: 186019...
CVE-2020-8181
A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars...
CVE-2020-14165
The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability...
Authorization
The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability...
Improper authorization in Project Administration - Others - CVE-2020-14165
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to obtain information about custom project avatars via an improper authorization vulnerability in the UniversalAvatarResource.getAvatars resource. Affected versions: version 8.9.0 Fixed versions: 8.9.0...
Improper authorization in Project Administration - Others - CVE-2020-14165
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to obtain information about custom project avatars via an improper authorization vulnerability in the UniversalAvatarResource.getAvatars resource. Affected versions: version 8.9.0 Fixed versions: 8.9.0...
vBulletin 5.0 < 5.5.4 - 'updateAvatar' Authenticated Remote Code Execution
?php / --------------------------------------------------------------------- vBulletin = 5.5.4 updateAvatar Remote Code Execution Vulnerability --------------------------------------------------------------------- author..............: Egidio Romano aka EgiX mail................:...