Livewire Remote Code Execution on File Uploads

In livewire/livewire prior to v2.12.7 and v3.5.2, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type e.g.,...

Insufficient Type Distinction

Overview livewire/livewire is an A front-end framework for Laravel. Affected versions of this package are vulnerable to Insufficient Type Distinction when validating uploaded files in the generateHashNameWithOriginalNameEmbedded function. An attacker can execute code by uploading a file with a...

CVE-2024-47823 Livewire Remote Code Execution (RCE) on File Uploads

Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to 2.12.7 and v3.5.2, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not...

CVE-2024-47823 Livewire Remote Code Execution (RCE) on File Uploads

Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to 2.12.7 and v3.5.2, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not...

CVE-2024-47823

CVE-2024-47823 affects livewire/livewire (Laravel). In versions before 2.12.7 and 3.5.2, the uploaded file extension is inferred from MIME type, not from the original filename, enabling an attacker to bypass validation and potentially achieve RCE when a PHP file with a valid MIME type is uploaded...

emacs: Gnus treats inline MIME contents as trusted

A flaw was found in Emacs. When Emacs is used as an email client, inline MIME attachments are considered to be trusted by default, allowing a crafted LaTeX document to exhaust the disk space or the inodes allocated for the partition where the /tmp directory is located. This issue possibly results...

Huawei EulerOS: Security Advisory for emacs (EulerOS-SA-2024-2412)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for emacs (EulerOS-SA-2024-2362)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CLSA-2024-1725550629 exim: Fix of CVE-2024-39929

CVE-2024-39929: fix incorrectly parsing MIME parses filenames that are specified using multiple parameters...

Cross-Site Request Forgery (CSRF)

Hono is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the CSRF middleware's case sensitivity in MIME type matching, which allows bypassing protection with upper-case MIME types...

Hono CSRF middleware can be bypassed using crafted Content-Type header

Summary Hono CSRF middleware can be bypassed using crafted Content-Type header. Details MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.tsL16-L17 As a...

GHSA-RPFR-3M35-5VX5 Hono CSRF middleware can be bypassed using crafted Content-Type header

Summary Hono CSRF middleware can be bypassed using crafted Content-Type header. Details MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.tsL16-L17 As a...

CVE-2024-43787

CVE-2024-43787: Hono CSRF middleware can be bypassed via crafted Content-Type header due to MIME-type matching only lower-case isRequestedByFormElementRe; this allows bypass of CSRF protection. Affected: Hono prior to 4.5.8. Impact per sources: CSRF protection bypass (low/partial impact described...

CVE-2024-43787 Hono CSRF middleware can be bypassed using crafted Content-Type header

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware...

CVE-2024-43787 Hono CSRF middleware can be bypassed using crafted Content-Type header

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware...

CVE-2024-43787 Hono CSRF middleware can be bypassed using crafted Content-Type header

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware...

PT-2024-30656 · Hono · Hono

Name of the Vulnerable Software and Affected Versions: Hono versions prior to 4.5.8 Description: The Hono CSRF middleware can be bypassed using a crafted Content-Type header. This is due to the fact that MIME types are case insensitive, but the isRequestedByFormElementRe function only matches...

CVE-2024-7906

A vulnerability classified as critical was found in DedeBIZ 6.3.0. This vulnerability affects the function getmimetype of the file /admin/dialog/selectimagespost.php of the component Attachment Settings. The manipulation of the argument upload leads to unrestricted upload. The attack can be...

Amazon Linux 2 : emacs (ALAS-2024-2608)

The version of emacs installed on the remote host is prior to 27.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2608 advisory. In Emacs before 29.3, Gnus treats inline MIME contents as trusted. CVE-2024-30203 In Emacs before 29.3, LaTeX preview is...

PT-2025-2647 · Unknown +1 · Otrs Community Edition +1

Name of the Vulnerable Software and Affected Versions: OTRS versions 6.0.x through 8.0.x OTRS versions 2023.x through 2024.x OTRS Community Edition version 6.0.x Description: The issue is related to the incorrect handling of HTTP request headers due to insufficient input validation, which may all...