1252 matches found
CVE-2024-7750
A vulnerability has been found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /medicines.php. The manipulation of the argument medicinename leads to sql injection. The attack can be launche...
Wanglong LTcms path traversal vulnerability
Wanglong LTcms is an enterprise website builder from China NetDragon Wanglong. A path traversal vulnerability exists in Wanglong LTcms version 1.0.20, which stems from an incorrect operation of the parameter file that can lead to path traversal...
PT-2024-38551 · Wanglongcn · Ltcms
Name of the Vulnerable Software and Affected Versions: wanglongcn ltcms version 1.0.20 Description: A critical issue has been found, affecting the downloadUrl function of the /api/file/downloadUrl API Endpoint. The manipulation of the file argument leads to server-side request forgery, which can ...
Security Bulletin: IBM Transformation Extender Advanced v10.0.x is affected by a vulnerability in its dependencies
Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine, is vulnerable to Unix File Parameter Alteration Vulnerability Details CVEID:CVE-2020-3452 DESCRIPTION: Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software could allow a remote...
TOTOLINK A3300R UploadCustomModule Function RCE
The vulnerability of the UploadCustomModule /cgi-bin/cstecgi.cgi function in the TOTOLINK A3300R router microprogramming software arises due to an overflow of the buffer on the stack during the processing of the File parameter. Exploiting this vulnerability allows a malicious actor to compromise...
Alien ALR-F800: Operating System Command Injection Vulnerability
The Alien ALR-F800 is an RFID sensor from Alien. An operating system command injection vulnerability exists in the Alien ALR-F800 version 19.10.24.00 and prior versions, which stems from the uploadedFile parameter in the /admin/system.html file containing an operating system command injection...
Alien ALR-F800: Operating System Command Injection Vulnerability
The Alien ALR-F800 is an RFID sensor from Alien. An operating system command injection vulnerability exists in the Alien ALR-F800 version 19.10.24.00 and prior versions, which stems from an operating system command injection vulnerability contained in the uploadedFile parameter in the File Name...
EMACS hfy-istext-command Code Execution
The vulnerability of the hfy-istext-command function in the EMACS text editor is related to improper escaping of output data. Exploiting this vulnerability allows an attacker to execute arbitrary code using the parameters “file” and “srcdir”...
TOTOLINK CP900 security vulnerabilities
The TOTOLINK CP900 is a wireless router. The TOTOLINK CP900 suffers from a buffer overflow vulnerability that stems from improper handling of the File parameter in the UploadCustomModule function of the file /cgi-bin/cstecgi.cgi. An attacker can use this vulnerability to cause a crash of the...
CVE-2024-7331
A vulnerability was found in TOTOLINK A3300R 17.0.0cu.557B20221024 and classified as critical. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to buffer overflow. The attack may be launched remotely. The explo...
PT-2024-5476 · Totolink · Totolink A3300R
Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: A critical issue was found in the UploadCustomModule function of the /cgi-bin/cstecgi.cgi file, which can be exploited remotely. The manipulation of the File argument leads to a buff...
PT-2024-5688
Name of the Vulnerable Software and Affected Versions Netcat Netshop CMS affected versions not specified Description The issue exists due to inadequate protection of the web page structure in the file parameter of the netshop CMS module. This could allow a remote attacker to execute arbitrary...
PT-2024-27870
Name of the Vulnerable Software and Affected Versions Phoniebox versions prior to 3.0 Description The issue is related to insecure handling of the file parameter in GET header requests sent to an instance of the open-source project Phoniebox. This allows an attacker to create a website that, when...
D-Link DAR-7000 code issue and vulnerabilities
DAR-7000 is an Internet Behavior Audit Gateway from China AUO D-Link. AUO Electronic Devices Shanghai Co. A code issue vulnerability exists in the DAR-7000, which stems from the file parameter of /log/decodmail.php being able to deserialize certain content. No details of the vulnerability are...
CVE-2024-5936
An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this vulnerabili...
CVE-2024-5936 Open Redirect in imartinez/privategpt
An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this vulnerabili...
CVE-2024-5936: URL Redirection to Untrusted Site
An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this vulnerabili...
PrivateGPT Input Validation Error Vulnerability
PrivateGPT is an AI project. An input validation error vulnerability exists in PrivateGPT version 0.5.0 that stems from mishandling of the file parameter, allowing an attacker to redirect a user to a URL specified by user-controlled input without proper validation or cleanup...
CVE-2024-3597
The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.2.2. This is due to insufficient validation on the redirect url supplied via the rcexportedzipfile parameter. This makes it possible for unauthenticated attackers to...
