CVE-2024-42906

TestLink before v.1.9.20 is vulnerable to Cross Site Scripting XSS via the pop-up on upload file. When uploading a file, the XSS payload can be entered into the file name...

Helpdeskz 2.0.2 Cross Site Scripting

Exploit Title: Stored XSS Vulnerability via File Name Google Dork: N/A Date: 08 Aug 2024 Exploit Author: Md. Sadikul Islam Vendor Homepage: https://www.helpdeskz.com/ Software Link: https://github.com/helpdesk-z/helpdeskz-dev/archive/2.0.2.zip Version: v2.0.2 Tested on: Kali Linux / Firefox...

Helpdeskz v2.0.2 - Stored XSS Vulnerability

Exploit Title: Stored XSS Vulnerability via File Name Exploit Author: Md. Sadikul Islam Vendor Homepage: https://www.helpdeskz.com/ Software Link: https://github.com/helpdesk-z/helpdeskz-dev/archive/2.0.2.zip Version: v2.0.2 Tested on: Kali Linux / Firefox 115.1.0esr 64-bit CVE : N/A Payload: "...

Helpdeskz v2.0.2 - Stored XSS

Exploit Title: Stored XSS Vulnerability via File Name Google Dork: N/A Date: 08 Aug 2024 Exploit Author: Md. Sadikul Islam Vendor Homepage: https://www.helpdeskz.com/ Software Link: https://github.com/helpdesk-z/helpdeskz-dev/archive/2.0.2.zip Version: v2.0.2 Tested on: Kali Linux / Firefox...

The vulnerability of the File Name Handler component in the Vim text editor allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the File Name Handler component in the Vim text editor exists due to a mistake in the use of pointers after memory release in the dialogchanged function. Exploiting this vulnerability can allow an attacker to trigger a pointer use-after-free error, resulting in a malfunction ...

PT-2024-6181 · Microsoft · Windows Compressed Folder +1

Name of the Vulnerable Software and Affected Versions: Windows Compressed Folder affected versions not specified Description: The issue is related to incorrect external management of a file's name or path in Windows operating systems. This can allow a remote attacker to gain unauthorized access t...

PT-2024-6549 · Microsoft · Outlook

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook affected versions not specified Description: The issue is related to incorrect external control of a file name or path in Microsoft Outlook for Windows operating systems. Exploitation of this issue may allow an attacker to...

CVE-2024-7579

A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function popen of the file /var/www/cgi-bin/upgrade.cgi of the component File Name Handler. The manipulation of the argument uploadedFile leads to os...

CVE-2024-7579 Alien Technology ALR-F800 File Name upgrade.cgi popen os command injection

A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function popen of the file /var/www/cgi-bin/upgrade.cgi of the component File Name Handler. The manipulation of the argument uploadedFile leads to os...

CVE-2024-7579

An issue affects Alien Technology ALR-F800 up to version 19.10.24.00. The vulnerability resides in the popen call within the File Name Handler component, specifically the /var/www/cgi-bin/upgrade.cgi file, where manipulating the uploadedFile argument leads to an OS command injection. The attack c...

CVE-2024-37403

Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting in a path traversal-affiliated vulnerability. This potentially enables other malicious apps on the device to read sensitive information...

Alien ALR-F800 操作系统命令注入漏洞

The Alien ALR-F800 is an RFID sensor from Alien. An operating system command injection vulnerability exists in the Alien ALR-F800 version 19.10.24.00 and prior versions, which stems from an operating system command injection vulnerability contained in the uploadedFile parameter in the File Name...

Security Bulletin: IBM Storage Ceph is vulnerable to External Control of File Name or Path in the RHEL UBI (CVE-2023-38546)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. CVE-2023-38546. Vulnerability Details CVEID:CVE-2023-38546 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security...

Ibexa Admin UI 安全漏洞

Ibexa Admin UI is an open source UI interface for Ibexa. Dedicated to the Ibexa Admin UI Bundle. A security vulnerability exists in Ibexa Admin UI that stems from the file upload widget being susceptible to a cross-site scripting payload in the file name...

CVE-2024-38432

Matrix Tafnit v8 - CWE-646: Reliance on File Name or Extension of Externally-Supplied File...

CVE-2024-38432

Matrix Tafnit v8 - CWE-646: Reliance on File Name or Extension of Externally-Supplied File...

CVE-2024-38432 Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied File

Matrix Tafnit v8 - CWE-646: Reliance on File Name or Extension of Externally-Supplied File...

CVE-2024-38432 Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied File

Matrix Tafnit v8 - CWE-646: Reliance on File Name or Extension of Externally-Supplied File...

CVE-2024-7182

A vulnerability, which was classified as critical, has been found in TOTOLINK A3600R 4.1.2cu.5182B20201102. This issue affects the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to buffer overflow. The attack may be initiated remotely. The...

PT-2024-38145 · Totolink · Totolink A3600R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3600R version 4.1.2cu.5182 B20201102 Description: A critical issue was found in the setUploadSetting function of the /cgi-bin/cstecgi.cgi file. The manipulation of the FileName argument leads to a buffer overflow. This issue can be...