PT-2024-35440

Name of the Vulnerable Software and Affected Versions libre-chat version 0.0.6 Description The issue allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file, specifically in the upload documents method. Recommendations For libre-chat version 0.0.6, consid...

XSS through document upload

This report is not public...

Cross-site Scripting (XSS)

Overview tribalsystems/zenario is a Zenario is a web-based content management system for sites with one or many languages. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the PDF upload functionality. An attacker can inject malicious scripts that are executed in t...

PT-2024-26243 · Dootask · Dootask

Name of the Vulnerable Software and Affected Versions: dootask version 0.30.13 Description: The issue allows attackers to execute arbitrary code via uploading a crafted PDF file, exploiting an arbitrary file upload vulnerability. Recommendations: For dootask version 0.30.13, update to a version...

Leantime Systems Leantime 跨站脚本漏洞

Leantime Systems Leantime is an open source project management system based on PHP and MySQL from Leantime Systems. A cross-site scripting vulnerability exists in Leantime version v3.0.6, which originates from a vulnerability that allows an attacker to execute arbitrary code by uploading a crafte...

Input validation

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper processing of serialized Java objects by the affected...

PT-2023-28363 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP Business Objects Business Intelligence Platform affected versions not specified Description: The issue allows an attacker to upload agnostic documents in the system, which when opened by any other user, could lead to a high impact on the...

Chamilo LMS Security Vulnerability

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training, and online question and answer sessions. A security vulnerability exists in Chamilo LMS v1.11.24 and prior versions,...

CVE-2023-46096

A vulnerability has been identified in SIMATIC PCS neo All versions V4.1. The PUD Manager of affected products does not properly authenticate users in the PUD Manager web service. This could allow an unauthenticated adjacent attacker to generate a privileged token and upload additional documents...

CVE-2023-46096

CVE-2023-46096 affects SIMATIC PCS neo (

PT-2023-6998 · Siemens · Simatic Pcs Neo

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo versions prior to V4.1 Description: The issue is related to a lack of authentication for a critical function in the administrative console of the SIMATIC PCS neo web system management technology process. This could allow a...

UBUNTU-CVE-2023-42462

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Users are advised to upgrade to version...

File deletion through document upload process in GLPI

[email protected] reports: GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files...

CVE-2023-42462 File deletion through document upload process in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Users are advised to upgrade to version...

CVE-2023-42462 File deletion through document upload process in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Users are advised to upgrade to version...

Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files

Impact A memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded into memory during upload for additional processing. A user with access to upload images or documents through the Wagtail admin interface could upload a fi...

PYSEC-2023-56

Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded into memory during upload for additional processing. A use...

CVE-2022-43996

The csafprovider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF advisories JSON format to be uploaded with Content-Type text/html and filenames ending in .html. When subsequently accessed via web browser, these advisories a...

PT-2022-25629 · Unknown · Transfer.Sh

Name of the Vulnerable Software and Affected Versions: Transfer.sh versions 1.4.0 and prior Description: The issue is related to Cross Site Scripting XSS and can be triggered via a malicious document uploaded in transfer.sh. There is no information about the estimated number of potentially affect...

YetiForceCrm 跨站脚本漏洞

YetiForceCrm is an open source Crm system from the Polish company YetiForce. A cross-site scripting vulnerability exists in YetiForceCrm versions prior to 6.4.0, which stems from a lack of content validation and output encoding, and can be exploited by an attacker by uploading a carefully crafted...