CVE-2024-54462 Unsanitized Filenames in Flutter package image_picker_android Allow File Overwrites

The file names constructed within imagepicker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using your app and could...

CVE-2024-37403

Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting in a path traversal-affiliated vulnerability. This potentially enables other malicious apps on the device to read sensitive information...

CVE-2024-35205

The WPS Office aka cn.wps.mofficeeng application before 17.0.0 for Android fails to properly sanitize file names before processing them through external application interactions, leading to a form of path traversal. This potentially enables any application to dispatch a crafted library file, aimi...

The vulnerability of the UploadFirmwareFile() function in the microprogramming software for TOTOLINK A3700R allows a hacker to execute arbitrary code.

The vulnerability of the UploadFirmwareFile function in the microprogrammed software of TOTOLINK A3700R wireless routers is related to the lack of measures to sanitize input data during the processing of the FileName parameter. Exploiting this vulnerability could allow an attacker to execute...

PHPFusion <= 9.10.30 Multiple Vulnerabilities

PHPFusion is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php-fusion:php-fusion";...

CVE-2023-26146

All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting XSS such that when a file with a name containing a malicious payload is served by the application, the filename is displayed without proper sanitization when it is rendered...

PT-2023-12821 · Unknown · Serve-Lite

Name of the Vulnerable Software and Affected Versions: serve-lite versions all Description: The issue arises when the software detects a request to a directory and renders a file listing of its contents. This listing includes links with actual file names, but these names are not sanitized or outp...

Remote Code Execution (RCE)

graphql-upload is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of file name via the upload function...

Directory Traversal in elFinder.AspNet

This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path...

CVE-2021-23415

CVE-2021-23415 affects elFinder.AspNet prior to 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path, enabling Directory Traversal. Remediation: upgrade elFinder.AspNet to version 1.1.1 or higher. In public disclosures, Snyk provides a PoC ...

CVE-2021-23407

This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is used to create a file system path...

Path traversal

This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is used to create a file system path...

SUSE: Security Advisory (SUSE-SU-2019:0643-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2019:0642-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-6914

It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory...

OPENSUSE-SU-2019:1110-1 Security update for lftp

This update for lftp fixes the following issues: Security issue fixed: - CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of the local system bsc1103367. Other issue addressed: - The SSH login handling code detects password prompts more reliably...

Security update for lftp (moderate)

openSUSE Security Update: Security update for lftp Announcement ID: openSUSE-SU-2019:1110-1 Rating: moderate References: 1103367 1120946 Cross-References: CVE-2018-10916 Affected Products: openSUSE Leap 15.0 An update that solves one vulnerability and has one errata is now available. Description:...

Security update for lftp (moderate)

openSUSE Security Update: Security update for lftp Announcement ID: openSUSE-SU-2019:1059-1 Rating: moderate References: 1103367 1120946 Cross-References: CVE-2018-10916 Affected Products: openSUSE Leap 42.3 An update that solves one vulnerability and has one errata is now available. Description:...

SUSE SLED12 / SLES12 Security Update : lftp (SUSE-SU-2019:0642-1)

This update for lftp fixes the following issues : Security issue fixed : CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of the local system bsc1103367. Other issue addressed: The SSH login handling code detects password prompts more reliably...

CVE-2018-10916

It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server,...