9401 matches found
Malicious code in saniibe-filename (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19bc3ef2771b6d5cf1f86fb61546632bb20d05e9ba7a9c5d6edeb598eade4d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2022-23129 · Directus · Directus
Name of the Vulnerable Software and Affected Versions: Directus versions prior to 9.15.0 Description: The Directus process can be aborted by having an authorized user update the filename disk value to a folder and accessing that file through the "/assets" endpoint. This issue has been patched and...
Zoo Management System 代码问题漏洞
Zoo Management System is a zoo management system by Carlo Montero, an individual developer. It provides an online and automated platform for zoo organizations to manage their daily records. A code issue vulnerability exists in Zoo Management System. An attacker could exploit the vulnerability by...
GHSA-8X94-HMJH-97HQ Django vulnerable to Reflected File Download attack
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input...
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example overwrite the .ssh/authorized_keys file).
...
CVE-2022-36264
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote Arbitrary File Upload vulnerability which allows overwriting arbitrary files. A malicious actor can remotely upload a file of their choice and overwrite any file in the system by manipulating the filename a...
CVE-2022-36264
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote Arbitrary File Upload vulnerability which allows overwriting arbitrary files. A malicious actor can remotely upload a file of their choice and overwrite any file in the system by manipulating the filename a...
Unauthenticated Path Traversal
Description A unauthenticated user can read and download files of the application system by abusing the filename parameter, of the /api/image/cover-uploadendpoint, that is not properly sanitized. Proof of Concept 1 - Send the following request, where the filename has the relative path of the targ...
DEBIAN-CVE-2022-36359
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input...
Django 安全漏洞
Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes an object-oriented mapper, a view system, a template system, and more. A security vulnerability exists in Django versions 3.2 prior to 3.2.15 and 4.0 prior to 4.0.7...
AZL-10461 CVE-2022-29154 affecting package rsync for versions less than 3.2.5-1
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...
ALPINE-CVE-2022-29154
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...
rsync 输入验证错误漏洞
rsync is an open source utility program by Wayne Davison, an individual developer, that provides fast incremental file transfers. A security vulnerability exists in versions prior to rsync 3.2.5 that stems from insufficient validation of filenames by the rsync client...
The vulnerability of the `setUpgradeFW` function in TOTOLINK router microprogramming devices, such as TOTOLINK A800R, TOTOLINK A810R, TOTOLINK A830R, TOTOLINK A950RG, TOTOLINK A3000RU, and TOTOLINK A3100R, allows a hacker to execute arbitrary commands.
The vulnerability of the setUpgradeFW function parameter FileName in the microprogramming software for TOTOLINK A800R, TOTOLINK A810R, TOTOLINK A830R, TOTOLINK A950RG, TOTOLINK A3000RU, and TOTOLINK A3100R routers is related to the lack of measures for cleaning input data. Exploiting this...
Drupal RCE Vulnerability (SA-CORE-2022-014) - Windows
Drupal is prone to a remote code execution RCE vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...
Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2022-014
Updated 2022-07-20 19:45 UTC to indicate that this only affects Apache web servers. Drupal core sanitizes filenames with dangerous extensions upon upload reference: SA-CORE-2020-012 and strips leading and trailing dots from filenames to prevent uploading server configuration files reference:...
Dompdf 安全漏洞
Dompdf is an HTML to PDF converter. A security vulnerability exists in Dompdf versions prior to 2.0.0, which originates from an externally controlled filename or path...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the filename parameter in the 'New Page' dialog on the Overview or Pages page. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an...
