2294 matches found
CVE-2022-42247
pfSense v2.5.2 was discovered to contain a cross-site scripting XSS vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name...
CVE-2022-42247
pfSense v2.5.2 was discovered to contain a cross-site scripting XSS vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name...
The vulnerability of the rcp.c component in the NetKit-rsh remote execution program allows a attacker to compromise data integrity.
The vulnerability of the rcp.c component in the NetKit-rsh remote execution program is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to compromise data integrity using a dummy file name or the file name “.”...
The vulnerability in the findfile.c component of the Vim text editor allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of the findfile.c component of the Vim text editor is related to the improper handling of CTR-W f when the file name is absent. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...
CVE-2022-41232
A cross-site request forgery CSRF vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file by providing a crafted file name to an API endpoint...
CVE-2022-36749
RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Files.php. This vulnerability is exploited via a crafted payload injected into the file name of an uploaded file...
CVE-2022-37076
TOTOLINK A7000R V9.1.0u.6115B20201022 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile...
CVE-2022-37076
TOTOLINK A7000R V9.1.0u.6115B20201022 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile...
CVE-2022-36486
TOTOLINK N350RT V9.3.5u.6139B20201216 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile...
PT-2022-23790 · Totolink · Totolink A7000R
Name of the Vulnerable Software and Affected Versions: TOTOLINK A7000R version 9.1.0u.6115 B20201022 Description: A command injection issue was found in the UploadFirmwareFile function via the FileName parameter. Recommendations: For version 9.1.0u.6115 B20201022, avoid using the FileName paramet...
TOTOLINK A7000R 操作系统命令注入漏洞
The TOTOLINK A7000R is a wireless router from China's Gion Electronics TOTOLINK. An operating system command injection vulnerability exists in the TOTOLINK A7000R version V9.1.0u.6115B20201022, which stems from a command injection issue in the FileName parameter of the UploadFirmwareFile method...
PT-2022-23408 · Totolink · Totolink N350Rt
Name of the Vulnerable Software and Affected Versions: TOTOLINK N350RT version 9.3.5u.6139 B20201216 Description: A command injection issue was found via the FileName parameter in the UploadFirmwareFile function. Recommendations: For version 9.3.5u.6139 B20201216, consider restricting access to t...
TOTOLINK A3700R 操作系统命令注入漏洞
The TOTOLINK A3700R is a wireless router from China's Gion Electronics TOTOLINK. An operating system command injection vulnerability exists in the TOTOLINK A3700R version V9.1.2u.6134B20201202, which stems from a command injection issue in the FileName parameter of the UploadFirmwareFile method...
Apache Hadoop 操作系统命令注入漏洞
Apache Hadoop is an open source distributed system infrastructure from the Apache Foundation. The product is capable of distributed processing of large amounts of data and is highly reliable, scalable, and fault-tolerant. Apache Hadoop has a security vulnerability that stems from its...
UBUNTU-CVE-2022-29154
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...
CVE-2022-29154
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...
WordPress plugin Transposh WordPress Translation 代码注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Transposh WordPress...
Transposh WordPress Translation 1.0.8.1 Remote Code Execution
RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Transposh WordPress Translation Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/ Type: Reliance on File Name or Extension of Externally-Supplied File...