1883 matches found
CVE-2024-10238
A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6. An attacker can upload a specially crafted image that will cause a stack overflow is caused by not checking fld-usedbytes...
CVE-2024-10238
CVE-2024-10238 affects Supermicro MBD-X12DPG-OA6 firmware image verification. The root cause is a stack overflow caused by not checking fld->used_bytes in the verification path. Public sources in the connected documents describe two related stack-overflow flaws in the firmware image verificati...
CVE-2024-10238 fld->used_bytes without sanity check causes stack overflow
A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6. An attacker can upload a specially crafted image that will cause a stack overflow is caused by not checking fld-usedbytes...
SuperMicro MBD-X12DPG-OA6 安全漏洞
The SuperMicro MBD-X12DPG-OA6 is a processor from SuperMicro USA. A security vulnerability exists in the Supermicro MBD-X12DPG-OA6. An attacker exploiting this vulnerability could upload a specially crafted image resulting in a stack overflow...
Supermicro MBD-X12DPG-OA6 安全漏洞
The SuperMicro MBD-X12DPG-OA6 is a processor from SuperMicro USA. A security vulnerability exists in the Supermicro MBD-X12DPG-OA6. An attacker exploiting this vulnerability could upload a specially crafted image resulting in a stack overflow...
Cross-site Scripting (XSS)
Overview backdrop/backdrop is a CMS that helps you build websites for businesses and non-profits. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insufficient validation of uploaded SVG images. A user with SVG upload privileges who convinces another user to...
PT-2025-5616 · Unknown · Backdrop Cms
Name of the Vulnerable Software and Affected Versions: Backdrop CMS versions 1.28.x through 1.28.4 Backdrop CMS versions 1.29.x through 1.29.2 Description: A security issue was discovered related to the validation of uploaded SVG images. These images can contain clickable links and executable...
CVE-2025-25063
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, ...
WordPress Social Share Buttons for WordPress plugin <= 2.7 - Unauthenticated Image Upload & Path Traversal vulnerability
Unauthenticated Image Upload & Path Traversal vulnerability discovered by Bob Matyas in WordPress Plugin Social Share Buttons for WordPress versions = 2.7...
CVE-2024-13117
The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded...
CVE-2024-13117
The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded...
CVE-2024-13117 Social Share Buttons for WordPress <= 2.7 - Unauthenticated Image Upload & Path Traversal
The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded...
CVE-2024-13117
CVE-2024-13117 affects Social Share Buttons for WordPress (plugin) up to version 2.7, allowing unauthenticated users to upload arbitrary images and alter the upload path. Root cause: improper upload handling enabling arbitrary file upload and path traversal. Impact: potential for arbitrary file u...
WordPress plugin Social Share Buttons 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...
CVE-2024-13698 Jobify - Job Board WordPress Theme <= 4.2.7 - Missing Authorization to Unauthenticated Server-Side Request Forgery, Arbitrary Image Upload, and Image Generation
The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'downloadimageviaai' and 'generateimageviaai' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticat...
CVE-2024-13698 Jobify - Job Board WordPress Theme <= 4.2.7 - Missing Authorization to Unauthenticated Server-Side Request Forgery, Arbitrary Image Upload, and Image Generation
The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'downloadimageviaai' and 'generateimageviaai' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticat...
PT-2025-2247 · WordPress · Jobify
Name of the Vulnerable Software and Affected Versions: Jobify - Job Board WordPress Theme for WordPress versions up to, and including, 4.2.7 Description: The issue concerns unauthorized access and modification of data due to a missing capability check in the download image via ai and generate ima...
CVE-2024-13361
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicgsaveimagemedia function in all versions up to, and including, 1.8.96. This makes it possible for authenticated attackers, with Subscriber-level access and above,...