Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in versions of Mozilla Firefox prior to 131, which stems from the fact that a specially crafted filename containing a large number of spaces may obscure the file's...

CVE-2024-47531

Scout is a web-based visualizer for VCF-files. Due to the lack of sanitization in the filename, it is possible bypass intended file extension and make users download malicious files with any extension. With malicious content injected inside the file data and users unknowingly downloading it and...

CVE-2024-47531 Scout contains insufficient output escaping of attachment names

Scout is a web-based visualizer for VCF-files. Due to the lack of sanitization in the filename, it is possible bypass intended file extension and make users download malicious files with any extension. With malicious content injected inside the file data and users unknowingly downloading it and...

Scout 安全漏洞

Scout is an open source platform from Clinical Genomics for analyzing VCFs and being able to aid collaborations to solve rare diseases faster. A security vulnerability exists in Scout versions prior to 4.89 that stems from a lack of filename cleanup and can bypass expected file extensions and all...

CVE-2024-46441

An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php called from app/admin/controller/ypay/Home.php. The file extension of an uncompressed file is not checked...

CVE-2024-46441

The payment system YPay version 1.2.0 contains an arbitrary file upload vulnerability that enables attackers to execute arbitrary code. The root cause is that the application fails to check the file extension of uncompressed files within a ZIP archive processed by the themePutFile function in app...

The vulnerability of the file_extension() function in the file.c component of the HTMLDOC document conversion tool allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failure.

The vulnerability of the fileextension function in the file.c component of the HTMLDOC document conversion tool is related to pointer dereferencing errors. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures...

Microsoft Windows Internet Explorer File Extension Spoofing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way Internet...

CVE-2024-8338

A vulnerability was found in HFO4 shudong-share 2.4.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /includes/fileReceive.php of the component File Extension Handler. The manipulation of the argument file leads to unrestricted upload. Th...

CVE-2024-8338 HFO4 shudong-share File Extension fileReceive.php unrestricted upload

A vulnerability was found in HFO4 shudong-share 2.4.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /includes/fileReceive.php of the component File Extension Handler. The manipulation of the argument file leads to unrestricted upload. Th...

CVE-2024-8338

CVE-2024-8338 affects HFO4 shudong-share 2.4.7. The vulnerability is in /includes/fileReceive.php of the File Extension Handler, where manipulating the file argument enables unrestricted remote upload. The exploit has been disclosed publicly and, per sources, this issue affects products no longer...

CVE-2024-8338

A vulnerability was found in HFO4 shudong-share 2.4.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /includes/fileReceive.php of the component File Extension Handler. The manipulation of the argument file leads to unrestricted upload. Th...

CVE-2024-8338 HFO4 shudong-share File Extension fileReceive.php unrestricted upload

A vulnerability was found in HFO4 shudong-share 2.4.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /includes/fileReceive.php of the component File Extension Handler. The manipulation of the argument file leads to unrestricted upload. Th...

PT-2024-38953 · Unknown · Hfo4 Shudong-Share

Name of the Vulnerable Software and Affected Versions: HFO4 shudong-share version 2.4.7 Description: A critical vulnerability was found in the file /includes/fileReceive.php of the component File Extension Handler. The manipulation of the file argument leads to unrestricted upload. The attack can...

CVE-2024-8338: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in HFO4 shudong-share 2.4.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /includes/fileReceive.php of the component File Extension Handler. The manipulation of the argument file leads to unrestricted upload. Th...

CVE-2022-1206

CVE-2022-1206 concerns the WordPress plugin AdRotate Banner Manager. The vulnerability is an arbitrary file upload caused by missing file extension sanitization in the adrotate_insert_media() function, affecting all versions up to and including 5.13.2. It requires authenticated access at administ...

CVE-2024-6451

AI Engine 2.4.3 is susceptible to remote-code-execution RCE via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of "logspath", allowing Administrators to change log filetypes from .log to .php...

CVE-2024-6451 AI Engine < 2.5.1 - Admin+ RCE

AI Engine 2.4.3 is susceptible to remote-code-execution RCE via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of "logspath", allowing Administrators to change log filetypes from .log to .php...

CVE-2024-6451

The AI Engine WordPress plugin (versions prior to 2.5.1 ) is vulnerable to Remote Code Execution (RCE) via Log Poisoning . The root cause is a failure to validate the file extension of the logs_path , which allows users with Administrator privileges to change the log file type from .log to .php ....

WordPress plugin AI Engine 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...