Improper Web Parameter Validation

httparty is the vulnerability of External Control of Assumed-Immutable Web Parameter. The vulnerability is caused due to The lack of escaping of the " Double-Quote character in Content-Disposition filename. This allows the attacker to modify the application data...

Malicious code in ether-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c0daa6287f78623d9fd9d2bd501403142d5196ad67ff5eb49c867d9dea7504a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lockself (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 763cacc0b344181f12ca9b91d4dc48926ded58e96d01fdfdb14acf86dfaaca4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

External Control Of File Name Or Path

h2o is vulnerable to External Control of File Name or Path. The vulnerability exists due to improper input validation which allows an attacker to manipulate file paths to access or modify files outside of the intended directories...

External Control of File Name or Path in h2oai/h2o-3

Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with "C1", if they're exporting ...

GHSA-GQRQ-J6PM-98C2 External Control of File Name or Path in h2oai/h2o-3

Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with "C1", if they're exporting ...

CVE-2023-6569

External Control of File Name or Path in h2oai/h2o-3...

Design/Logic Flaw

External Control of File Name or Path in h2oai/h2o-3...

CVE-2023-6569 External Control of File Name or Path in h2oai/h2o-3

External Control of File Name or Path in h2oai/h2o-3...

CVE-2023-6569

The CVE-2023-6569 entry concerns h2oai/h2o-3 with a vulnerability labeled as External Control of File Name or Path. Connected sources describe a remote, unauthenticated possibility for an attacker to overwrite arbitrary server files with attacker-controlled data; in the GHSA advisory this involve...

Malicious code in cosmos-wallet-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6583493058b4f8536df13eb5c7c6418badcae8f4c6cb5122d75ad79db0f174fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The software for Mitsubishi Electric GX Works3 programming is vulnerable. The software includes control tools for applications in industrial automation systems, namely MELSOFT iQ AppPortal, MELSOFT Navigator, and Motion Control Setting. This vulnerability allows a malicious individual to execute arbitrary code, disclose protected information, and trigger service failures.

The vulnerabilities of the software for programming Mitsubishi Electric GX Works3, as well as the software tools for managing applications in industrial automation systems such as MELSOFT iQ AppPortal, MELSOFT Navigator, and Motion Control Setting, are related to external control mechanisms...

Malicious code in pdf2htmlextest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8b2331e000213f0f48b8ff8f978a0ce93926cf42935a72a611195eee4b7b4c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mitsubishi Electric FA Engineering Software Products

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION : Low attack complexity Vendor : Mitsubishi Electric Equipment : FA Engineering Software Products Vulnerability : External Control of File Name or Path 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a malicious...

Malicious code in sofa1-shop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2755f958af07d7b6ae67d65d8716e99ac2110252da50a85dd160343dbf4c7962 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-34982

This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service...

Xxe

This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service...

CVE-2023-34982 AVEVA Operations Control Logger External Control of File Name or Path

This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service...

CVE-2023-34982

CVE-2023-34982 affects AVEVA Operations Control Logger (external control of file name or path). A local OS-authenticated user with standard privileges could delete files with System privileges, leading to denial of service. The CVE is discussed across multiple sources (NVD entry and AVEVA/ICS adv...

ROS-20231109-01

Go programming language vulnerability is related to insecure external control of critical state data state when processing the setuid and setgid attributes. Exploitation of the vulnerability could allow an attacker, acting remotely, escalate their privileges and gain access to read, modify, or...