2288 matches found
CVE-2023-2554
CVE-2023-2554 affects unilogies/bumsys prior to 2.2.0. The issue is External Control of File Name or Path, enabling path traversal via user-supplied input used to build file paths in easyUpload, potentially allowing arbitrary file write. Public sources (NVD/Red Hat/Rust) rate severity as HIGH (CV...
CVE-2023-2554 External Control of File Name or Path in unilogies/bumsys
External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0...
CVE-2023-2554 External Control of File Name or Path in unilogies/bumsys
External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0...
CVE-2023-31284
illumos illumos-gate before 676abcb has a stack buffer overflow in /dev/net, leading to privilege escalation via a stat on a long file name in /dev/net...
PT-2023-23271 · Illumos · Illumos
Name of the Vulnerable Software and Affected Versions: illumos illumos-gate versions before 676abcb Description: The issue is a stack buffer overflow in /dev/net, which can lead to privilege escalation. This can be achieved via a stat on a long file name in /dev/net. Recommendations: For versions...
GHSA-22GJ-8QJ2-FJ46 Moodle External Control of File Name or Path vulnerability
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system...
Moodle External Control of File Name or Path vulnerability
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system...
CVE-2023-29800
TOTOLINK X18 V9.1.0cu.2024B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function...
TOTOLINK X18 命令注入漏洞
The TOTOLINK X18 is a mesh router system from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK X18 version V9.1.0cu.2024B20220329, which originates from a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function...
PT-2023-11805
Name of the Vulnerable Software and Affected Versions Tailor Mangement System version 1 Description A SQL injection issue allows a remote attacker to execute arbitrary code via the customer parameter of the "orderadd.php" file. This enables the attacker to potentially access and manipulate...
Nextcloud 代码问题漏洞
Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, a German company. A code issue vulnerability exists in Nextcloud server that stems from the ability to control file names when uploading a website icon as an administrator ...
Amazon Linux 2023 : xz, xz-devel, xz-libs (ALAS2023-2023-042)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-042 advisory. An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's...
CVE-2023-28617
org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters...
CVE-2023-28617
org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters...
Path Traversal
github.com/dablelv/go-huge-util is vulnerable to Path Traversal. The vulnerability exists due to the Create function in file/file.go because the library fails to strip ../ from the uncompressed file name, which allows an attacker to traverse outside the expected directory...
Command Injection
emacs is vulnerable to Command Injection. The vulnerability exists because the input parameters are not properly escaped in the hfy-istext-command function, which allows an attacker to inject and execute malicious commands when the file name or directory name contains shell metacharacters...
Arbitrary File Write
nilsteampassnet/teampass is vulnerable to External Control Of File Name. The vulnerability is due to a lack of santization in the path element, which allows an attacker to write arbitrary files outside the expected directory...
CVE-2023-1105
External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3...
