93 matches found
CVE-2024-55354
Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let an attacker run code that would be expected to be blocked and access resources that would be expected to be protected...
CVE-2024-55354
Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let an attacker run code that would be expected to be blocked and access resources that would be expected to be protected...
CVE-2022-25773
This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to...
CVE-2022-25773 Relative Path Traversal in assets file upload
This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to...
CVE-2022-25773
CVE-2022-25773 describes a file placement/path traversal vulnerability in Mautic’s asset upload, due to improper pathname restriction that allows uploading assets to directories outside the intended temp dir. Connected sources confirm affected component paths (mautic/core-lib) and versions before...
CVE-2022-25773 Relative Path Traversal in assets file upload
This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to...
Toshiba e-STUDIO Security Vulnerability
Toshiba e-STUDIO is a line of high-end office multifunction printers from Toshiba Japan. A security vulnerability exists in Toshiba e-STUDIO that originates from the use of a Web-based management program TopAccess that can place any file in the multifunction device...
Toshiba e-STUDIO Security Vulnerability
Toshiba e-STUDIO is a line of high-end office multifunction printers from Toshiba Japan. A security vulnerability exists in Toshiba e-STUDIO that originates from the use of a Web-based management program TopAccess that can place any file in the multifunction device...
Toshiba e-STUDIO Security Vulnerability
Toshiba e-STUDIO is a line of high-end office multifunction printers from Toshiba Japan. A security vulnerability exists in Toshiba e-STUDIO that originates from the use of a Web-based management program TopAccess that can place any file in the multifunction device...
Toshiba e-STUDIO Security Vulnerability
Toshiba e-STUDIO is a line of high-end office multifunction printers from Toshiba Japan. A security vulnerability exists in Toshiba e-STUDIO that originates from the use of a Web-based management program TopAccess that can place any file in the multifunction device...
Multiple vulnerabilities in UTAU
Overview UTAU provided by ameya/ayame contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2024-28886 Path Traversal CWE-22 - CVE-2024-32944 Yu Ishibashi reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early...
CVE-2024-32944
Path traversal vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product installs a crafted UTAU voicebank installer .uar file, .zip file to UTAU, an arbitrary file may be placed...
CVE-2024-32944
CVE-2024-32944 affects UTAU prior to v0.4.19. The issue is a path traversal vulnerability where installing a crafted voicebank installer (.uar or .zip) can place arbitrary files in UTAU. Supported by multiple sources (NVD/Red Hat/JVN/CVE records and PT-Security), the root cause relates to handlin...
CVE-2024-32944
Path traversal vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product installs a crafted UTAU voicebank installer .uar file, .zip file to UTAU, an arbitrary file may be placed...
CVE-2024-35186
gitoxide, a pure Rust Git implementation, has a vulnerability in gix-worktree-state where checkout ignores that paths must reside in the working tree. A specially crafted repository can cause new files to be created anywhere writable by the application during clone, impacting confidentiality, int...
GHSA-7W47-3WG8-547C gix traversal outside working tree enables arbitrary code execution
Summary During checkout, gitoxide does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. Details Although gix-worktree-state checks for collisions with existing files, it does not...
gix traversal outside working tree enables arbitrary code execution
Summary During checkout, gitoxide does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. Details Although gix-worktree-state checks for collisions with existing files, it does not...
RUSTSEC-2024-0348 Traversal outside working tree enables arbitrary code execution
Summary During checkout, gitoxide does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. Details Although gix-worktree-state checks for collisions with existing files, it does not...
CVE-2024-31226
Sunshine (Moonlight’s self-hosted game stream host) for Windows is affected in versions 0.17.0–0.22.2 when running as a service. An attacker could place a file named C:\Program.exe, C:\Program.bat, or C:\Program.cmd on the target machine and trigger hijacked execution flow during service terminat...
CVE-2024-21805
Improper access control vulnerability exists in the specific folder of SKYSEA Client View versions from Ver.16.100 prior to Ver.19.2. If this vulnerability is exploited, an arbitrary file may be placed in the specific folder by a user who can log in to the PC where the product's Windows client is...