SUSE CVE-2023-29539

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox 112, Focus f...

CVE-2023-29542

The Mozilla Foundation Security Advisory describes this flaw as: A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code. This bu...

SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2023:1819-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1819-1 advisory. - Firefox Extended Support Release 102.10.0 ESR bsc1210212 - CVE-2023-29531: Out-of-bound memory access in WebGL on macOS -...

Mozilla Thunderbird Security Advisory (MFSA2023-15) - Mac OS X

Thunderbird is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

UBUNTU-CVE-2023-29539

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox 112, Focus f...

CVE-2023-27179

GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /admin/imgdownload.php...

CVE-2023-27179

GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /admin/imgdownload.php...

Arbitrary file deletion

GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /admin/imgdownload.php...

CVE-2023-27179

GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /admin/imgdownload.php...

PT-2023-20991 · Unknown · Gdidees Cms

Name of the Vulnerable Software and Affected Versions: GDidees CMS versions 3.9.1 and lower Description: The issue is related to an arbitrary file download via the filename parameter at the "/ admin/imgdownload.php" API endpoint. This allows unauthorized access to files on the system...

CVE-2023-27179

GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /admin/imgdownload.php...

Mozilla Firefox ESR 代码问题漏洞

Mozilla Firefox ESR is an extended support release of Firefox web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox ESR versions prior to 102.10, which stems from a truncated filename if the filename contains NULL characters when processi...

Mozilla Firefox ESR 安全漏洞

Mozilla Firefox ESR is an extended support release of Firefox web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox ESR prior to version 102.10, which originates from a line break in a filename that can bypass the file extension security...

Security Vulnerabilities fixed in Firefox ESR 102.10 — Mozilla

An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash.This bug only affects Firefox for macOS. Other operating systems are unaffected. A local attacker can trick the Mozilla Maintenance Service into applying...

GDidees CMS 代码问题漏洞

GDidees CMS is a website builder from GDidees. A security vulnerability exists in GDidees CMS version v3.9.1 and earlier versions, which originated from a discovery of an arbitrary file download vulnerability via the filename parameter of /admin/imgdownload.php...

Minecraft 路径遍历漏洞

Minecraft My World is a Swedish sandbox game by Mojang. A security vulnerability exists in Minecraft BiblioCraft versions prior to 2.4.6 that stems from not cleaning up path traversal characters in filenames...

Attached files under salaries module can be harvested by unauthenticated users

Description File attachment under salaries module can be downloaded and viewed by anyone without authentication by just knowing the full path /assets/FileUploads/2022/staff2/ and the predictable filename contains date YYYY-MM-DD and a random 6 digit number which can be easily enumerated by...

PT-2023-35753 · Git +1 · Binutils

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided input. Description: The issue is related to a heap-use-after-free READ 3 crash type. The crash state involves functions such as filename cmp, debug start source, and parse stab. N...

PYSEC-2023-29

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1...

CVE-2022-28497

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 is discovered to contain a command injection vulnerability in the mtdwritebootloader function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...