CVE-2023-29401 Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin

The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of...

CVE-2023-29401 Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin

The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of...

CVE-2023-29401

CVE-2023-29401 affects the Gin web framework (Context.FileAttachment filename handling). A maliciously crafted filename can make Content-Disposition header use an unexpected name, potentially serving a file with a name different from the one provided. The CVE is scored 4.3 (MEDIUM) with network a...

Gin 安全漏洞

Gin is a small JavaScript Markdown editor built with Electron by Marius Küng, a personal developer. Gin suffers from a security vulnerability that stems from an improperly cleaned filename parameter in the Context.FileAttachment function, which can be exploited by an attacker to modify the...

CVE-2023-29152

By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account...

CVE-2023-29152

By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account...

Design/Logic Flaw

By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account...

CVE-2023-29152 PTC Vuforia Studio Improper Authorization

By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account...

CVE-2022-25834

In Percona XtraBackup PXB through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands...

UBUNTU-CVE-2022-25834

In Percona XtraBackup PXB through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands...

PT-2023-12820 · Percona +1 · Percona Xtrabackup +1

Name of the Vulnerable Software and Affected Versions: Percona XtraBackup versions 2.2.0 through 2.2.24 Percona XtraBackup versions 3.0.0 through 8.0.27-19 Description: A crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands...

PT-2023-22172 · Ptc · Vuforia

Name of the Vulnerable Software and Affected Versions: Vuforia affected versions not specified Description: The issue allows an attacker to delete any file with the permissions of the Vuforia server account by changing the filename parameter in the request. Recommendations: At the moment, there i...

Percona XtraBackup 命令注入漏洞

Percona XtraBackup is an open source hot backup utility for MySQL databases from Percona USA. A security vulnerability exists in Percona XtraBackup PXB versions prior to 8.0.27-19, which can be exploited by an attacker to trigger an unexpected command shell to execute arbitrary commands via a...

SonicJS 路径遍历漏洞

SonicJS is a content management system based on modern open source NodeJs by Lane Personal Developer. A security vulnerability exists in SonicJS v0.7.0 and earlier versions that stems from injecting special characters into the filename of a backup CMS, allowing an attacker to perform authenticate...

CVE-2023-33690

SonicJS up to v0.7.0 allows attackers to execute an authenticated path traversal when an attacker injects special characters into the filename of a backup CMS...

PT-2023-24449 · Sonicjs · Sonicjs

Name of the Vulnerable Software and Affected Versions: SonicJS versions up to 0.7.0 Description: The issue allows attackers to execute an authenticated path traversal when special characters are injected into the filename of a backup CMS. Recommendations: For SonicJS versions up to 0.7.0, update ...

CVE-2023-33690

SonicJS up to v0.7.0 allows attackers to execute an authenticated path traversal when an attacker injects special characters into the filename of a backup CMS...

DEBIAN-CVE-2023-29539

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox 112, Focus f...

CVE-2023-29539

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox 112, Focus f...

CVE-2023-29539

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox 112, Focus f...