CVE-2022-20250

In Messaging, there is a possible way to attach files to a message without proper access checks due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

CVE-2022-20241

In Messaging, there is a possible way to attach a private file to an SMS message due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

PT-2022-14463 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to improper input validation in the Messaging component, allowing the attachment of private files to SMS messages. This could lead to local information disclosure without requiring...

PT-2022-25412

Name of the Vulnerable Software and Affected Versions xdg-mail affected versions not specified Description The issue arises when xdg-mail is configured to use thunderbird for mailto URLs, leading to improper parsing of the URL. This can result in additional headers being passed to thunderbird tha...

CVE-2022-29454 WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WordPlus Better Messages plugin = 1.9.9.148 at WordPress allows attackers to upload files. File attachment to messages must be activated...

CVE-2021-37941

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of...

We’re Excited to Announce the Launch of Comms Hub!

We are excited to announce the launch of Comms Hub to the Researcher Portal submission experience! With this launch, security researchers will be able to streamline communication with MSRC case SPMs case managers, attach additional files, track case and bug bounty status all in the Researcher...

Cybozu Garoon Attaching Files Incorrectly Entered Validation Vulnerability

A security vulnerability exists in Attaching Files in Cybozu Garoon, a portal-based OA office system from Cybozu Japan. An attacker could use this vulnerability to obtain data from the attached files...

Machform Cross-Site Scripting Vulnerability

MachForm is an HTML form builder that lets you create contact forms, surveys, order forms or any other web form without writing code. A stored cross-site scripting vulnerability exists in versions prior to Machform 16. The vulnerability stems from insufficient validation of file attachments...

CVE-2021-20104

MachForm prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uploaded with forms through upload.php. Affected software: MachForm

How to Attach Files to a Veeam Support Case

Purpose This article documents how to attach files to a Veeam Support case. Methods Below are the two methods portal or SFTP used to attach files to a support case. Expand a section to learn more. Attach files to the Support case via the My Account portal. 1. Sign In to the My Account portal. 2...

CVE-2020-18723

Stored cross-site scripting XSS in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities...

CVE-2020-18723

Stored cross-site scripting XSS in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities...

Cross site scripting

Stored cross-site scripting XSS in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities...

CVE-2020-18723: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting XSS in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities...

CVE-2019-16959

SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...

Mail.ru: Database read through file attachment [content://]

Local malicious application selected as a file picker by user could obtain access to ICQ for Android local database by returning a content URI...

CVE-2020-27359: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user could craft a messag...

CVE-2020-15162

PrestaShop contains a Stored XSS vulnerability (CVE-2020-15162) affecting versions 1.5.0.0 up to, but not including, 1.7.6.8. Attackers could upload compromised attachments that input malicious JavaScript. The issue is fixed in 1.7.6.8; upgrading to that version is the recommended remediation.

Cross site scripting

eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object. For example, the filename has a complete XSS payload followed by the .png extension...