OPENSUSE-SU-2024:10262-1 jakarta-commons-fileupload-1.1.1-125.11 on GA media

These are all security issues fixed in the jakarta-commons-fileupload-1.1.1-125.11 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12950-1 apache-commons-fileupload-1.5-1.1 on GA media

These are all security issues fixed in the apache-commons-fileupload-1.5-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10620-1 apache-commons-fileupload-1.4-1.9 on GA media

These are all security issues fixed in the apache-commons-fileupload-1.4-1.9 package on the GA media of openSUSE Tumbleweed...

RHEL 8 : httl (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - Apache Commons FileUpload: FileUpload DoS with excessive parts CVE-2023-24998 Note that Nessus has not tested for...

RHEL 7 : httl (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - Apache Commons FileUpload: FileUpload DoS with excessive parts CVE-2023-24998 Note that Nessus has not tested for...

Apache Tomcat 8.0.0.RC1 < 8.0.36

The version of Tomcat installed on the remote host is prior to 8.0.36. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.5.3and8.0.36security-8 advisory. - The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x befor...

Apache Tomcat 8.5.0 < 8.5.3

The version of Tomcat installed on the remote host is prior to 8.5.3. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.5.3and8.0.36security-8 advisory. - The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before...

Apache Tomcat 9.0.0.M1 < 9.0.0.M8

The version of Tomcat installed on the remote host is prior to 9.0.0.M8. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.0.m8security-9 advisory. - The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before...

Important: tomcat

Issue Overview: Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option...

Amazon Linux 2 : tomcat (ALAS-2024-2517)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2517 advisory. Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the...

PT-2024-27878 · Vesystem · Vesystem Cloud Desktop

Name of the Vulnerable Software and Affected Versions: Vesystem Cloud Desktop versions up to 20240408 Description: A critical vulnerability was found in Vesystem Cloud Desktop, affecting the file /Public/webuploader/0.1.5/server/fileupload.php. The manipulation of the file argument leads to...

Vesystem Cloud Desktop 代码问题漏洞

Vesystem Cloud Desktop is a cloud desktop system from China's Hexin Chuangtian Vesystem. A code issue vulnerability exists in Vesystem Cloud Desktop 20240408 and prior versions, which stems from the parameter file in the file /Public/webuploader/0.1.5/server/fileupload.php that can lead to...

Security Bulletin: IBM Transformation Extender Advanced is vulnerable to multiple issues due to IBM WebSphere Application Server Liberty.

Summary IBM Transformation Extender Advanced, previously known as IBM Standards Processing Engine, uses IBM WebSphere Application Server Liberty. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to denial of service due to Apache Commons FileUpload (CVE-2023-24998)

Summary IBM Sterling Partner Engagement Manager uses Apache Commons FileUpload. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by no...

Security Bulletin: Vulnerability in commons-fileupload affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0)[CVE-2023-24998]

Summary The commons-fileupload package is used by IBM Cloud Pak for Data System 2.0. IBM Cloud Pak for Data System 2.0 has addressed the applicable CVE CVE-2023-24998 Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service...

BIT-WORDPRESS-MULTISITE-2020-11026 Specially crafted filenames in WordPress leading to XSS

In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. This has been patched in version 5.4.1, along with all the previousl...

BIT-JENKINS-2023-27900

Jenkins LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service...

BIT-JENKINS-2023-27901

Jenkins LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service...

Security Bulletin: Vulnerabilities in IBM WebSphere Application Server Liberty impact IBM Common Licensing

Summary Multiple vulnerabilities in IBM WebSphere Liberty impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application...

GHSA-GP6M-FQ6H-CJCX Magento LTS vulnerable to stored XSS in admin file form

Summary OpenMage is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Details MageAdminhtmlBlockSystemConfigFormFieldFile does not escape filename value in certain situations. Same...