SUSE CVE-2017-7765

The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Internet. Without the Mark of the Web data, the security warning that Windows displays before running executables downloaded from the Internet is not shown. Note: This attack only...

SUSE CVE-2018-6559

The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10, allows local users to obtain names of files in which they would not normally be able to access via an overlayfs mount inside of a user namespace...

SUSE CVE-2018-10916

It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server,...

SUSE CVE-2018-19060

An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path...

SUSE CVE-2018-1000177

A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in...

SUSE CVE-2020-5283

ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS showsubdirlastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the...

SUSE CVE-2022-29154

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...

SUSE CVE-2022-45939

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags " command suggested in the ctags...

SUSE CVE-2023-22456

ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 and 1.1.29. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository...

February 14, 2023—KB5022838 (OS Build 14393.5717) - EXPIRED

None None...

CVE-2022-47417

LogicalDOC Enterprise and Community Edition CE are vulnerable to a stored persistent, or "Type II" cross-site scripting XSS condition in the document file name...

WEPA Print Away 跨站脚本漏洞

WEPA Print Away is a cloud-based print management solution organized by the University of Wisconsin-Milwaukee. WEPA Print Away has a security vulnerability that stems from not properly cleaning up uploaded file names. An attacker exploited the vulnerability to perform a cross-site scripting attac...

PT-2023-18607 · F5 · F5Os-A +1

Name of the Vulnerable Software and Affected Versions: F5OS-A versions 1.2.0 through 1.2.x F5OS-C versions 1.3.0 through 1.4.x Description: The issue allows for command injection when processing F5OS tenant file names. This may potentially lead to unauthorized access or control. No information is...

PT-2023-10019 · Unknown · Flash Tool

Name of the Vulnerable Software and Affected Versions: flash tool gem versions prior to 0.6.0 Description: The issue allows command execution via shell metacharacters in the name of a downloaded file. It is triggered during the handling of downloaded files that contain shell characters, enabling ...

Cross site scripting

Cross site scripting XSS vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via file names...

CVE-2022-45557

Cross site scripting XSS vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via file names...

CVE-2022-45557

Concrete details found: CVE-2022-45557 affects Hundredrabbits Left, version 7.1.5 on macOS, due to a cross-site scripting (XSS) in file names. Root cause is improper handling/sanitization of filenames leading to script execution. Impact aligns with XSS, enabling arbitrary code execution via craft...

Siemens Automation License Manager File Name or Path External Control Vulnerability

The Automation License Manager ALM centrally manages license keys for various Siemens software products. Software products that require a license key automatically report this requirement to ALM. When ALM finds a valid license key for the software, the software can be used according to the end-us...

GHSA-PFPR-3463-C6JH ruby-git has potential remote code execution vulnerability

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the git ls-files command using eval to unescape quoted file names. If a file name was added to the git repository contained special characters, such as \n, then the git ls-files command would print the file name in...

Potential remote code execution in ruby-git

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the 'git ls-files' command using eval to unescape quoted file names. If a file name was added to the git repository contained special characters, such as '\n', then the 'git ls-files' command would print the file nam...