50 matches found
CVE-2020-10254
An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its preview...
Cross site scripting
An issue was discovered on Cayin SMP-PRO4 devices. They allow imagepreview.html?filename= reflected XSS...
CVE-2020-6955
An issue was discovered on Cayin SMP-PRO4 devices. They allow imagepreview.html?filename= reflected XSS...
Mail.ru: IP address can be leaked on Image preview in ICQ for Android chat
Описание: При отправке пользователю изображения, в android версии в web и mac версии клиента этой проблемы не наблюдаю со внешнего ресурса, при открытии превью изображения "жертвой", отправляется запрос на внешний сервер с IP адреса клиента. Воспроизведение: 1. Отправляем пользователю сообщение с...
Memphis Document Library Plugin <= 3.1.5 - Arbitrary File Download
The function "mdocsimgpreview" is in charge of downloading image previews previously uploaded by the administrator, but it does not sanitize the file path being downloaded, thus, allowing to download arbitrary files in the file system. The vulnerable GET parameter is "mdocs-img-preview". The...
CVE-2014-5237
Server-side request forgery SSRF vulnerability in the documentconverter component in Open-Xchange OX AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote attackers to trigger requests to arbitrary servers and embed arbitrary images via a URL in an embedded image in a Text...
Server side request forgery (ssrf)
Server-side request forgery SSRF vulnerability in the documentconverter component in Open-Xchange OX AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote attackers to trigger requests to arbitrary servers and embed arbitrary images via a URL in an embedded image in a Text...
Remote command injection in Ruby Gem kelredd-pruview 0.3.8
Remote command injection in Ruby Gem kelredd-pruview 0.3.8 Larry W. Cashdollar 4/4/2013 @larry0 Description: "A gem to ease generating image previews thumbnails of various files." https://rubygems.org/gems/kelredd-pruview Remote commands can be executed if the file name contains shell meta...
CVE-2008-6480
CVE-2008-6480 describes a CSRF vulnerability in Datalife Engine 6.7, specifically in engine/modules/imagepreview.php, where an attacker can hijack the authentication of arbitrary users by sending requests with a modified image parameter. The vulnerability affects the imagepreview functionality an...