1155 matches found
SUSE CVE-2018-1000177
A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in...
SUSE CVE-2020-5283
ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS showsubdirlastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the...
SUSE CVE-2022-29154
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...
SUSE CVE-2022-45939
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags " command suggested in the ctags...
SUSE CVE-2023-22456
ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 and 1.1.29. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository...
February 14, 2023—KB5022838 (OS Build 14393.5717) - EXPIRED
None None...
CVE-2022-47417
LogicalDOC Enterprise and Community Edition CE are vulnerable to a stored persistent, or "Type II" cross-site scripting XSS condition in the document file name...
WEPA Print Away 跨站脚本漏洞
WEPA Print Away is a cloud-based print management solution organized by the University of Wisconsin-Milwaukee. WEPA Print Away has a security vulnerability that stems from not properly cleaning up uploaded file names. An attacker exploited the vulnerability to perform a cross-site scripting attac...
PT-2023-18607 · F5 · F5Os-A +1
Name of the Vulnerable Software and Affected Versions: F5OS-A versions 1.2.0 through 1.2.x F5OS-C versions 1.3.0 through 1.4.x Description: The issue allows for command injection when processing F5OS tenant file names. This may potentially lead to unauthorized access or control. No information is...
CVE-2023-22657: Improper Neutralization of Special Elements used in a Command
On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F5OS tenant file names may allow for command injection. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
PT-2023-10019 · Unknown · Flash Tool
Name of the Vulnerable Software and Affected Versions: flash tool gem versions prior to 0.6.0 Description: The issue allows command execution via shell metacharacters in the name of a downloaded file. It is triggered during the handling of downloaded files that contain shell characters, enabling ...
Cross site scripting
Cross site scripting XSS vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via file names...
CVE-2022-45557
Cross site scripting XSS vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via file names...
CVE-2022-45557
Concrete details found: CVE-2022-45557 affects Hundredrabbits Left, version 7.1.5 on macOS, due to a cross-site scripting (XSS) in file names. Root cause is improper handling/sanitization of filenames leading to script execution. Impact aligns with XSS, enabling arbitrary code execution via craft...
CVE-2022-45557: Improper Neutralization of Input During Web Page Generation
Cross site scripting XSS vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via file names...
Siemens Automation License Manager File Name or Path External Control Vulnerability
The Automation License Manager ALM centrally manages license keys for various Siemens software products. Software products that require a license key automatically report this requirement to ALM. When ALM finds a valid license key for the software, the software can be used according to the end-us...
GHSA-PFPR-3463-C6JH ruby-git has potential remote code execution vulnerability
The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the git ls-files command using eval to unescape quoted file names. If a file name was added to the git repository contained special characters, such as \n, then the git ls-files command would print the file name in...
Potential remote code execution in ruby-git
The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the 'git ls-files' command using eval to unescape quoted file names. If a file name was added to the git repository contained special characters, such as '\n', then the 'git ls-files' command would print the file nam...
