GHSA-VM6R-J788-HJH5 Contao affected by remote command execution through file upload

Impact Back end users with access to the file manager can upload malicious files and execute them on the server. Patches Update to Contao 4.13.49, 5.3.15 or 5.4.3. Workarounds Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory...

PT-2024-6334 · Winzip · Winzip

Name of the Vulnerable Software and Affected Versions: WinZip versions prior to 29.0 Description: The issue is related to a Mark-of-the-Web Bypass Vulnerability in WinZip, allowing remote attackers to bypass the Mark-of-the-Web protection mechanism. This can be exploited when a user opens a...

PT-2024-31602 · Contao · Contao

Name of the Vulnerable Software and Affected Versions: Contao versions prior to 4.13.49 Contao versions prior to 5.3.15 Contao versions prior to 5.4.3 Description: Contao is an Open Source CMS. In affected versions, a back end user with access to the file manager can upload malicious files and...

PT-2024-30967 · Apple · Ios +3

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.7.1 macOS versions prior to 14.7 macOS versions prior to 15 iOS versions prior to 17.7 iOS versions prior to 18 iPadOS versions prior to 17.7 iPadOS versions prior to 18 visionOS versions prior to 2 Description: The...

The vulnerability of the microprogrammed network device software of Zyxel ATP, USG FLEX, and USG FLEX 50(W)/USG20(W)-VPN lies in the lack of measures to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of the microprogrammed software in Zyxel ATP, USG FLEX, and USG FLEX 50W/USG20W-VPN devices is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

Microsoft Publisher Protection Mechanism Failure Vulnerability

Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files...

Unrestricted File Upload

FeehiCMS is vulnerable to unrestricted file upload. The vulnerability is due to lack of proper restrictions on file uploads in the User argument within the insert function of FeehiCMS, which allows an attacker to upload malicious files remotely, potentially leading to unauthorized code execution ...

Kashipara Music Management System File Upload Vulnerability (CNVD-2024-37437)

Kashipara Music Management System is a music management system from Kashipara. A file upload vulnerability exists in Kashipara Music Management System version 1.0, which stems from /music/ajax.php?action=savegenre lacks effective validation of uploaded files and can be exploited by an attacker to...

Versa Director 代码问题漏洞

Versa Director is a virtualization and service creation platform from Versa USA. It simplifies the creation, automation and delivery of services using Versa FlexVNF. A code issue vulnerability exists in Versa Director that stems from a misuse of the Change Favorite Icon option, which can lead to...

PT-2024-6031

Name of the Vulnerable Software and Affected Versions: Versa Director versions prior to 22.1.4 Description: The vulnerability in Versa Director allows attackers to upload malicious files, posing a serious threat to organizations. This flaw can be exploited by authenticated users with...

Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handli...

Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Dimension. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsin...

Microsoft Office PowerPoint PPTX File Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Office PowerPoint. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2024-7694

ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server...

CVE-2024-7694 TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload

ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server...

CVE-2024-7694 TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload

ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server...

SchoolPlus 1.0 Shell Upload

============================================================================================================================================= | Title : SchoolPlus v1.0 Remote File Upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64...

WordPress plugin Business Card 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in th...

New Chrome Feature Scans Password-Protected Files for Malicious Content

Google said it's adding new security warnings when downloading potentially suspicious and malicious files via its Chrome web browser. "We have replaced our previous warning messages with more detailed ones that convey more nuance about the nature of the danger and can help users make more informe...

Cisco Identity Services Engine Arbitrary File Upload (cisco-sa-ise-file-upload-krW2TxA9)

According to its self-reported version, Cisco Identity Services Engine Arbitrary File Upload is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to upload arbitrary files to an...