2294 matches found
apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus "limited" path traversal,...
apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus "limited" path traversal,...
apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus "limited" path traversal,...
CVE-2021-23439
This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded a user needs to be tricked into uploading such a file...
CVE-2021-23439
This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded a user needs to be tricked into uploading such a file...
Cross-site Scripting (XSS)
Overview file-upload-with-preview is an A simple file-upload utility that shows a preview of the uploaded image. Written in pure JavaScript. No dependencies. Works well with Bootstrap 4 or without a framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS. A file...
Ruby: XSS exploit of RDoc documentation generated by rdoc
Vulnerability description not provided...
apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus "limited" path traversal,...
Invision Community 安全特征问题漏洞
Invision Community is a software for designing and developing mobile application UI from Invision, Inc. A security signature vulnerability exists in Invision Community, which originates in the product's mtrand function that enables brute-force attacks on uploaded files to predict file names. The...
CVE-2020-23171
A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash characters included in the name of the crafted file...
Directory Traversal in elFinder.AspNet
This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path...
Design/Logic Flaw
libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the CURLOPTSSLCERT option --cert with the command line tool.When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificat...
CVE-2021-22926
libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the CURLOPTSSLCERT option --cert with the command line tool.When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificat...
CVE-2021-23415
This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path...
Path traversal
This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path...
CVE-2021-23415
CVE-2021-23415 affects elFinder.AspNet prior to 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path, enabling Directory Traversal. Remediation: upgrade elFinder.AspNet to version 1.1.1 or higher. In public disclosures, Snyk provides a PoC ...
CURLOPT_SSLCERT mix-up with Secure Transport
libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the CURLOPTSSLCERT option --cert with the command line tool. When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certifica...
[ASA-202107-35] dino: directory traversal
Arch Linux Security Advisory ASA-202107-35 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-33896 Package : dino Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-2043 Summary ======= The package dino before version...