Mozilla: Drag and Dropped Filenames could have been truncated to malicious extensions

The Mozilla Foundation Security Advisory describes this flaw as: A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code...

PT-2022-27763 · Unknown · Drag/Drop Xblock

Name of the Vulnerable Software and Affected Versions: Drag and Drop XBlock v2 versions prior to 3.0.0 Description: The issue affects the Drag and Drop XBlock v2, which implements a drag-and-drop style problem. It is vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that...

PT-2022-24250 · F Secure · F-Secure Safe Browser

Name of the Vulnerable Software and Affected Versions: F-Secure SAFE Browser versions prior to 19.0 Description: A Drag and Drop spoof vulnerability was discovered, allowing a spoofing of the address bar when a user performs a drag and drop operation on the address bar. Recommendations: For...

USN-5504-1 firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, bypass CSP restrictions, bypass sandboxed iframe restrictions, obtain sensitive...

UBUNTU-CVE-2022-34482

An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from...

WordPress Drag & Drop Builder plugin <= 1.4.9.3 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability was discovered by Hitesh Kumar in WordPress Drag & Drop Builder plugin versions = 1.4.9.3. Solution Update the WordPress Drag & Drop Builder plugin to the latest available version at least 1.4.9.4...

CVE-2021-24689

The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack...

CVE-2021-24689

CVE-2021-24689 concerns the WordPress plugin Contact Forms - Drag & Drop Contact Form Builder (versions up to 1.0.5). The vulnerability is a path traversal flaw that allows high-privilege users to download arbitrary files from the web server, via the plugin’s file download feature. The core issue...

WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin <= 1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin versions = 1.2. Solution No patched version available...

WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin <= 1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin versions = 1.2. Solution No patched version available...

Mozilla: Drag and dropping an image could have resulted in the dropped object being an executable

The Mozilla Foundation Security Advisory describes this flaw as: If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script, which would have run arbitrary code after the user clicked it...

Mozilla Firefox 安全漏洞

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. An arbitrary code execution vulnerability exists in Mozilla Thunderbird versions prior to...

CVE-2020-8292

Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting XSS vulnerability via the drag & drop functionality in message boxes...

CVE-2020-8292

Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting XSS vulnerability via the drag & drop functionality in message boxes...

Cross site scripting

Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting XSS vulnerability via the drag & drop functionality in message boxes...

CVE-2020-8292

Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting XSS vulnerability via the drag & drop functionality in message boxes...

[SECURITY] Fedora 32 Update: filezilla-3.48.1-1.fc32

FileZilla is a FTP, FTPS and SFTP client for Linux with a lot of features. - Supports FTP, FTP over SSL/TLS FTPS and SSH File Transfer Protocol SFT P - Cross-platform - Available in many languages - Supports resume and transfer of large files greater than 4GB - Easy to use Site Manager and transf...

Pwndrop - Self-Deployable File Hosting Service For Red Teamers, Allowing To Easily Upload And Share Payloads Over HTTP And WebDAV

pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV. If you've ever needed to quickly set up an nginx/apache web server to host your files and you were never happy with the limitations of python -m...

TestLink node_id parameter SQL injection vulnerability

TestLink is a set of open source software for managing the software testing process and providing statistical analysis. A SQL injection vulnerability exists in TestLink version 1.9.20. An attacker can exploit this vulnerability by executing arbitrary SQL commands in dragdroptreenodes.php with the...

CVE-2019-17051

Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonstrated by a one-click attack involving a drag-and-drop operation on a crafted Terminal file...