9406 matches found
CVE-2021-44892
A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...
CVE-2021-45738
TOTOLINK X5000R v9.1.0u.6118B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allows attackers to execute arbitrary commands via the parameter FileName...
Command injection
TOTOLINK X5000R v9.1.0u.6118B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allows attackers to execute arbitrary commands via the parameter FileName...
TotoLink X5000R 命令注入漏洞
TOTOLINK X5000R is a router. TOTOLINK X5000R v9.1.0u.6118B20201102 is vulnerable to a stack overflow vulnerability, which can be exploited by attackers to execute arbitrary commands via the parameter FileName...
Mageia: Security Advisory (MGASA-2020-0453)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-5247-1 vim vulnerabilities
It was discovered that vim incorrectly handled parsing of filenames in its search functionality. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service. This issue only affected Ubuntu 21.10. CVE-2021-3973 It was...
CVE-2022-22828
An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string...
Design/Logic Flaw
An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string...
CVE-2022-22828
An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string...
Synametrics Technologies SynaMan 信息泄露漏洞
Synametrics Technologies SynaMan is a remote file manager from Synametrics Technologies, USA. Synametrics Technologies SynaMan suffers from an information disclosure vulnerability that stems from an insecure direct object reference to a file download URL in SynaMan prior to 5.0. An attacker can...
DEBIAN-CVE-2021-45844
Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filename...
CVE-2021-45844
Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filename...
Input validation
Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filename...
CVE-2021-45844
Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filename...
CVE-2021-45844
Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filename...
FreeCad 操作系统命令注入漏洞
FreeCad is a free and open source general-purpose parametric 3D Cad modeler from the FreeCad community and supports the finite element method of building information modeling software. A command injection vulnerability exists in FreeCAD version 0.19, which stems from improper cleanup when calling...
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory and thus allows writing to locations outside of the destination.
...
CVE-2021-46255
eyouCMS V1.5.5-UTF8-SP31 suffers from Arbitrary file deletion due to insufficient filtering of the parameter filename...