Directory traversal

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.19 via the renameitem function. This makes it possible for authenticated attackers to rename arbitrary files on the server. This can lead ...

PT-2023-31915

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.4 Description The issue allows users with the media.manage media permission to upload files to the Media Manager and rename them after uploading, potentially leading to a stored XSS attack. This is because medi...

CVE-2023-52083: Improper Neutralization of Input During Web Page Generation

Winter is a free, open-source content management system. Prior to 1.2.4, users with the media.managemedia permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a...

The vulnerability of the file renaming function of the ASUSTOR Data Master operating system allows a hacker to move any files they desire.

The vulnerability of the file renaming function of the ASUSTOR Data Master operating system involves the use of files and directories accessible from external parties. Exploiting this vulnerability could allow a hacker to move arbitrary files...

The vulnerability of the umask() function in the archive_write_disk.posix.c component of the Libarchive library, which allows an attacker to delete and rename files within directories.

The vulnerability of the umask function in the archivewritedisk.posix.c component of the Libarchive library arises due to synchronization errors when using a shared resource. Exploiting this vulnerability could allow an attacker to delete and rename files within these directories...

CVE-2023-4475

An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master ADM allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below...

CVE-2023-4475

An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master ADM allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below...

CVE-2023-4475 An Arbitrary File Movement vulnerability was found on the ADM

An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master ADM allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below...

CVE-2023-4475

ASUSTOR Data Master (ADM) is affected by an Arbitrary File Movement vulnerability via the file renaming feature. Affected: ADM 4.0.6.RIS1 and below, ADM 4.1.0 and below, ADM 4.2.2.RI61 and below. Root cause: exploitation of the file renaming mechanism to move files into unintended directories. Im...

ASUSTOR Data Master 安全漏洞

ASUSTOR Data Master is a proprietary operating system for ASUSTOR NAS from ASUS in China, featuring a tablet-like graphical interface comparable to a zero-learning curve, making it easy to get started right away. A security vulnerability exists in ASUSTOR Data Master, which stems from the presenc...

PT-2023-7490 · Asustor · Asustor Data Master

Name of the Vulnerable Software and Affected Versions: ASUSTOR Data Master ADM versions 4.0.6.RIS1 and below ASUSTOR Data Master ADM versions 4.1.0 and below ASUSTOR Data Master ADM versions 4.2.2.RI61 and below Description: An Arbitrary File Movement issue was found in ASUSTOR Data Master ADM,...

CVE-2023-4475: Files or Directories Accessible to External Parties

An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master ADM allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below...

CVE-2023-2684

The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-2684 File Renaming on Upload < 2.5.2 - Admin+ Stored Cross-Site Scripting

The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-2684

CVE-2023-2684 affects the WordPress plugin File Renaming on Upload (before 2.5.2). Root cause: the plugin does not sanitize and escape certain settings, enabling stored cross-site scripting by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Impact is...

WordPress Plugin File Renaming on Upload 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress File Renaming on Upload Plugin < 2.5.2 is vulnerable to Cross Site Scripting (XSS)

Software File Renaming on Upload Type Plugin Vulnerable versions 2.5.2 Fixed in 2.5.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2684 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 40dbdf1fdc55 Credits Hao Huynh My Le...

PT-2023-20815 · WordPress · File Renaming On Upload

Name of the Vulnerable Software and Affected Versions: File Renaming on Upload WordPress plugin versions prior to 2.5.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

CVE-2023-2684: Undefined Security Weakness

The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

File Permission Bypass

libarchive.so is vulnerable to File Permission Bypass. The vulnerability exists due to a race condition in archivewritediskheader function at archivewritediskposix.c because the unmasking process does not take intro consideration other threads working on the same file, which allows an attacker to...