Command injection

A vulnerability was found in Exciting Printer and classified as critical. This issue affects some unknown processing of the file lib/printer/jobs/preparepage.rb of the component Argument Handler. The manipulation of the argument URL leads to command injection. The patch is named...

CVE-2017-20158 vova07 Yii2 FileAPI Widget UploadAction.php run cross site scripting

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The...

yii2 跨站脚本漏洞

Yii is a component-based, high-performance PHP framework for developing large-scale Web applications developed by the YII team. A cross-site scripting vulnerability exists in version 0.1.8 and earlier versions of yii2, which stems from incorrect manipulation of the parameter file resulting in...

CVE-2021-4293

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as problematic has been found in gnuboard youngcart5 up to 5.4.5.1. Affected is an unknown function of the file adm/menulistupdate.php. The manipulation of the argument melink leads to cross site scripting. It is possible to launch the attack...

GHSA-RMJ9-Q58G-9QGG go-unzip vulnerable to Path Traversal

Due to improper path santization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

Cloud Foundry Archiver vulnerable to path traversal

Due to improper path santization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

Cloud Foundry Archiver vulnerable to path traversal

Due to improper path santization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

CVE-2021-4292

A vulnerability was found in OpenMRS Admin UI Module up to 1.4.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/metadata/privileges/privilege.gsp of the component Manage Privilege Page. The manipulation leads to cross site...

CVE-2020-36566

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

CVE-2021-4287

A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation leads to symlink following. It is possible to launch the...

CVE-2021-4281

CVE-2021-4281 affects Brave UX for-the-badge. The vulnerability involves manipulation of an unknown functionality in the file .github/workflows/combine-prs.yml, leading to OS command injection. A patch is named 55b5a234c0fab935df5fb08365bc8fe9c37cf46b, with recommendations to apply the fix. Conne...

Design/Logic Flaw

A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the file screenshotsync of the component Filename Handler. The manipulation leads to predictable from observable state. The name of the patch is...

CVE-2022-34483

An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from...

CVE-2022-34483

The issue is CVE-2022-34483 affecting Firefox prior to version 102. A user engaging via drag-and-drop of an image to a filesystem could have resulted in a filename containing an executable extension, potentially leading to execution of malicious code. The Astra Linux advisories corroborate that F...

CVE-2022-34482

An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from...

CVE-2022-4641

A vulnerability was found in pig-vector and classified as problematic. Affected by this issue is the function LogisticRegression of the file src/main/java/org/apache/mahout/pig/LogisticRegression.java. The manipulation leads to insecure temporary file. The attack needs to be approached locally. T...

Path Traversal

plexus-utils is vulnerable to Path Traversal. An attacker can access arbitrary files and directories stored on the file system through the extractFile function in Expand.java and manipulate files with dot-dot-slash ../ sequences and variations or by using absolute file paths...

CVE-2020-36620 Brondahl EnumStringValues EnumExtensions.cs GetStringValuesWithPreferences_Uncache resource consumption

A vulnerability was found in Brondahl EnumStringValues up to 4.0.0. It has been declared as problematic. This vulnerability affects the function GetStringValuesWithPreferencesUncache of the file EnumStringValues/EnumExtensions.cs. The manipulation leads to resource consumption. Upgrading to versi...

Delta 4G Router DX-3021

1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION: Exploitable remotely/low attack complexity Vendor : Delta Industrial Automation Equipment: 4G Router DX-3021 Vulnerabilities: Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote unauthenticated user to...

Delta Electronics DX-3021 命令注入漏洞

The Delta Electronics DX-3021 is a router from Delta Electronics China. A command injection vulnerability exists in the Delta Electronics DX-3021 prior to version 1.24, which stems from a command injection vulnerability in the web server via the web diagnostics page, which could allow an...