1747 matches found
WordPress Easy Logo Plugin <= 1.9.3 is vulnerable to Cross Site Scripting (XSS)
Software Easy Logo Type Plugin Vulnerable versions = 1.9.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32083 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ab618ce8f1b6 Credits Cronus Required privilege Administrator...
CVE-2024-3025 Path Traversal in mintplex-labs/anything-llm
mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this vulnerability by manipulating the logo filename to reference files outside of the restricted directory. This can...
CVE-2024-3025
The CVE-2024-3025 entry affects mintplex-labs/anything-llm, where the logo filename handling allows path traversal due to insufficient input validation. Attackers can reference files outside the restricted directory via the logo upload endpoint, exposing the application’s database and potentially...
CVE-2024-3025 Path Traversal in mintplex-labs/anything-llm
mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this vulnerability by manipulating the logo filename to reference files outside of the restricted directory. This can...
AnythingLLM 安全漏洞
AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in AnythingLLM that stems from insufficient validation of user-supplied input in the logo filename feature, which could lead to a path traversal attack...
PT-2024-23297 · Mintplex · Anything-Llm
Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm affected versions not specified Description: The issue is related to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this by...
WordPress Change default login logo,url and title plugin <= 2.0 - CSRF to XSS vulnerability
CSRF to XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Change default login logo,url and title versions = 2.0...
WordPress Change default login logo,url and title Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)
Software Change default login logo,url and title Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31086 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 9e9f68e4407b Credits...
Wallos < 1.11.2 - File Upload RCE
Exploit Title: Wallos - File Upload RCE Authenticated Date: 2024-03-04 Exploit Author: [email protected] Vendor Homepage: https://github.com/ellite/Wallos Software Link: https://github.com/ellite/Wallos Version: -----------------------------29251442139...
CVE-2024-29858
In MISP before 2.4.187, uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload...
PT-2024-23086 · Misp · Misp
Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.187 Description: The issue concerns a weak security check in the uploadLogo function within the OrganisationsController.php file. This function does not properly validate logo uploads. Recommendations: For versions...
CVE-2024-29858
In MISP before 2.4.187, uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload...
MISP 安全漏洞
MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics with features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.187, which stems from uploadLo...
CVE-2024-29858
CVE-2024-29858 affects MISP prior to 2.4.187. The issue is in the uploadLogo function (app/Controller/OrganisationsController.php) which does not properly validate uploaded logos, i.e., it does not correctly check for a valid logo file. This could lead to unsafe logo uploads. Remediation: upgrade...
CVE-2024-29858
In MISP before 2.4.187, uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload...
CVE-2024-2561
A vulnerability, which was classified as critical, has been found in 74CMS 3.28.0. Affected by this issue is the function sendCompanyLogo of the file /controller/company/Index.phpsendCompanyLogo of the component Company Logo Handler. The manipulation of the argument imgBase64 leads to unrestricte...
CVE-2024-2561 74CMS Company Logo Index.php#sendCompanyLogo unrestricted upload
A vulnerability, which was classified as critical, has been found in 74CMS 3.28.0. Affected by this issue is the function sendCompanyLogo of the file /controller/company/Index.phpsendCompanyLogo of the component Company Logo Handler. The manipulation of the argument imgBase64 leads to unrestricte...
74CMS 安全漏洞
74CMS is an online recruitment system based on PHP and MySQL. A file upload vulnerability exists in version 3.28.0 of 74CMS, which stems from the lack of valid validation of the uploaded file by imgBase64, a parameter of the function sendCompanyLogo in file /controller/company/Index.php. The...
Deserialization of untrusted data
The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8 via deserialization via shortcode of untrusted input. This makes it possible for authenticated attackers, with contributor...
CVE-2024-1951 Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid <= 1.3.8 - Authenticated(Contributor+) PHP Object Injection
The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8 via deserialization via shortcode of untrusted input. This makes it possible for authenticated attackers, with contributor...