983 matches found
Sendinblue for WooCommerce < 4.0.18 - Authenticated (Editor+) Arbitrary File Download and Deletion
Description The Brevo for WooCommerce plugin for WordPress is vulnerable to arbitrary file download and deletion in all versions up to, and including, 4.0.17. This is due to the plugin not properly validating file names in the getfilecontents and deleteattachment functions. This makes it possible...
CVE-2024-20359
A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary code...
CVE-2024-20359
A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary code...
CVE-2024-20359
CVE-2024-20359 affects Cisco ASA and Cisco FTD. A legacy capability flaw allows an authenticated local attacker to exploit improper validation of a file read from flash memory by copying a crafted file to disk0:, enabling arbitrary code execution with root privileges after the next device reload....
CVE-2023-7201
The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...
CVE-2024-3025
The CVE-2024-3025 entry affects mintplex-labs/anything-llm, where the logo filename handling allows path traversal due to insufficient input validation. Attackers can reference files outside the restricted directory via the logo upload endpoint, exposing the application’s database and potentially...
Import XML and RSS Feeds < 2.1.6 - Authenticated (Administrator+) Arbitrary File Upload
Description The Import XML and RSS Feeds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the moovesetfeaturedimage function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with administrator-level...
CVE-2024-27346
CVE-2024-27346 concerns a vulnerability in Kofax Power PDF related to the parsing of PDF files. The flaw is a failure to validate user-supplied data, causing a read past the end of an allocated buffer in the PDF handling code, which can lead to an information disclosure . Some sources note that a...
File Validation Bypass
ezsystems/ezplatform-kernel is vulnerable to File Validation Bypass. The vulnerability is due to improper file validation, which allows an attacker to save article content even if its rejected during validation...
File Validation Bypass
ibexa/core is vulnerable to File Validation Bypass. The vulnerability is due to inadequate file type validation within the validate function in FileExtensionBlackListValidator.php. When attempting to publish content with rejected file types, the validation fails which does prevent publication, bu...
GHSA-9J39-4686-M3C4 Ibexa Kernel's files with blacklisted extensions can be still saved to drafts
Impact File validation can be configured to reject certain files by file type. When this happens, validation fails, and the content can't be published. However, the file can be saved when saving the content draft. This means unwanted files can be present in storage, even if they are not easily...
Ibexa Kernel's files with blacklisted extensions can be still saved to drafts
Impact File validation can be configured to reject certain files by file type. When this happens, validation fails, and the content can't be published. However, the file can be saved when saving the content draft. This means unwanted files can be present in storage, even if they are not easily...
Ibexa Kernel's files with blacklisted extensions can be still saved to drafts
Impact File validation can be configured to reject certain files by file type. When this happens, validation fails, and the content can't be published. However, the file can be saved when saving the content draft. This means unwanted files can be present in storage, even if they are not easily...
GHSA-MWVH-P3HX-X4GG Ibexa Kernel's files with blacklisted extensions can be still saved to drafts
Impact File validation can be configured to reject certain files by file type. When this happens, validation fails, and the content can't be published. However, the file can be saved when saving the content draft. This means unwanted files can be present in storage, even if they are not easily...
CVE-2024-27317
A path traversal vulnerability was found in Apache Pulsar. Pulsar allows authenticated users to upload functions to be run by the Pulsar Function Workers, these codes are in the format of a ZIP file. When extracting the uploaded ZIP file Pulsar fails to properly validate the file names contained ...
GHSA-672R-97R7-VX2Q pretix mishandles file validation
pretix before 2024.1.1 mishandles file validation...
pretix mishandles file validation
pretix before 2024.1.1 mishandles file validation...
CVE-2024-27447
pretix before 2024.1.1 mishandles file validation...
