53 matches found
CVE-2026-24910
In Bun before 1.3.5, the default trusted dependencies list aka trust allow list can be spoofed by a non-npm package in the case of a matching name for file, link, git, or github...
CVE-2024-39904
VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on the victim's system. A crafted URI can be used in a note to perform this attack using file:/// as a link. For example,...
Linkwarden 安全漏洞
Linkwarden is a self-hosted collaborative bookmark manager from Linkwarden Open Source. A security vulnerability exists in Linkwarden version 2.10.2, which stems from an unvalidated file:// link and could lead to a data leak...
CVE-2024-1493
An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the serve...
Vulnerabilities fixed in Microsoft Office
Microsoft has fixed vulnerabilities in several Office products. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges and execute arbitrary code with the victim's privileges. Successful exploitation requires the malicious party to trick the victim into openi...
The vulnerability of Trend Micro Deep Security Agent lies in its improper handling of file access links, which allows attackers to trigger a service failure.
The vulnerability of the Trend Micro Deep Security Agent lies in the improper handling of the link before accessing a file. Exploiting this vulnerability can allow an attacker to trigger a service failure...
The vulnerability of Trend Micro Deep Security Agent lies in its improper handling of file access links, which allows attackers to escalate their privileges.
The vulnerability of the Trend Micro Deep Security Agent lies in the incorrect handling of the link before accessing a file. Exploiting this vulnerability can allow attackers to enhance their privileges...
OESA-2024-2431 python-requests security update
Requests is an HTTP library, written in Python, as an alternative to Python's builtin urllib2 which requires work even method overrides to perform basic tasks. Features of Requests: - GET, HEAD, POST, PUT, DELETE Requests: + HTTP Header Request Attachment. + Data/Params Request Attachment. +...
VulnCheck KEV: CVE-2017-11511
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...
CVE-2024-39904
VNote (note‑taking platform) before version 3.18.1 is affected by a code execution vulnerability that can be triggered via crafted notes containing local file references (for example, file:///C:/WINDOWS/system32/cmd.exe or calc.exe). The underlying issue is a local file path handling/URI embeddin...
The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing lies in the possibility of an operation exceeding the buffer boundaries in memory, allowing a hacker to execute arbitrary code.
The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing is related to the execution of operations beyond the buffer boundaries in memory when processing PLY format files. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading...
SUSE CVE-2008-4910
The BasicService in Sun Java Web Start allows remote attackers to execute arbitrary programs on a client machine via a file:// URL argument to the showDocument method...
Cross site scripting
In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in $filelink in class/KippoInput.class.php...
kippo-graph 跨站脚本漏洞
kippo-graph is a full-featured script by the individual developer Ioannis Koniaris. It is used to visualize statistics for Kippo-based SSH honeypots. A security vulnerability exists in kippo-graph versions prior to 1.5.1, which stems from a cross-site scripting vulnerability in $filelink in...
Nystudio107 Seomatic 跨站脚本漏洞
Nystudio107 Seomatic is a comprehensive, powerful and flexible turnkey SEO system in the USA. Facilitates modern SEO best practices and implementation of Craft CMS 3. A security vulnerability exists in Nystudio107 Seomatic version 3.4.10, which can be exploited by a remote attacker to inject...
Proofpoint Phish Harvests Microsoft O365, Google Logins
Phishers are impersonating Proofpoint, the cybersecurity firm, in an attempt to make off with victims’ Microsoft Office 365 and Google email credentials. According to researchers at Armorblox, they spotted one such campaign lobbed at an unnamed global communications company, with nearly a thousan...
CVE-2011-1136
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file...
PT-2019-15171 · Pdf Xchange · Pdf-Xchange Editor
Name of the Vulnerable Software and Affected Versions: PDF-XChange Editor versions prior to 8.0.330.0 Description: The issue allows for NTLM SSO hash theft using crafted FDF or XFDF files. This can occur when a link to a file, such as '192.168.0.2C$file.pdf', is accessed without user interaction,...
DEBIAN-CVE-2018-10583
An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt...
LibreOffice 6.03 /Apache OpenOffice 4.1.5 Malicious ODT File Generator
Generates a Malicious ODT File which can be used with auxiliary/server/capture/smb or similar to capture hashes. Module Options msf use auxiliary/fileformat/odt/badodt msf undefinedbadodt show actions ...actions... msf undefinedbadodt set ACTION msf undefinedbadodt show options ...show and set...