137 matches found
BIT-SOLR-2024-52012 Apache Solr: Configset upload on Windows allows arbitrary path write-access
Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API. Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths t...
Apache Solr Relative Path Traversal vulnerability
Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API. Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths t...
CVE-2024-52012
Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API. Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths t...
CVE-2024-52012 Apache Solr: Configset upload on Windows allows arbitrary path write-access
Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API. Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths t...
CVE-2024-52012 Apache Solr: Configset upload on Windows allows arbitrary path write-access
Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API. Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths t...
GO-2024-3326 SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel...
Malicious code in nayan-imgur-upload-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b98ebdb98b3110329cb9db3c496ef6fa0d0f21bcf8ec8302746d6f47b0cf884 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11808 Malicious code in nayan-imgur-upload-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b98ebdb98b3110329cb9db3c496ef6fa0d0f21bcf8ec8302746d6f47b0cf884 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
SiYuan has an arbitrary file write in the host via /api/asset/upload
Summary The /api/asset/upload endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored XSS via the file write. Impact Arbitrary file write...
Malicious code in imgur-upload-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70fc21112f21105a413aa69a8b3e3f21c53895809a2f5fd20cdbf6dd16baadfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11144 Malicious code in imgur-upload-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70fc21112f21105a413aa69a8b3e3f21c53895809a2f5fd20cdbf6dd16baadfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2024-31214: Unrestricted Upload of File with Dangerous Type
Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Attackers have full control over the file contents, full control over the directory where the file is stored, full control over the file...
CVE-2023-47464
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function...
CVE-2023-47464
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function...
Code injection
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function...
PT-2023-8992 · Gl.Inet · Gl-Inet Ax1800
Name of the Vulnerable Software and Affected Versions: GL.iNet AX1800 versions 4.0.0 through 4.4.x Description: The issue is related to insecure permissions, allowing a remote attacker to execute arbitrary code via the "upload API function". This can be achieved by sending a request to the "uploa...
CVE-2023-47464: Improper Limitation of a Pathname to a Restricted Directory
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function...
CVE-2023-21640
Memory corruption in Linux when the file upload API is called with parameters having large buffer...