365 matches found
CVE-2024-48069
A vulnerability exists in Weaver E-cology versions 9. * where attackers can exploit race conditions to bypass security mechanisms. This flaw can lead to the upload of malicious files and the acquisition of server privileges . Additionally, a remote code execution (RCE) issue in the /inventory/doC...
CVE-2024-37869
File Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote attacker to execute arbitrary code via the "poster.php" file, and the uploaded file was received using the "$- FILES" variable...
CVE-2024-45621
The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser upon encountering third-party external actions from PDF documents...
CVE-2024-45621
CVE-2024-45621 affects the Electron-based Rocket.Chat desktop app up to version 6.3.4. The issue is a stored XSS vulnerability caused by handling links in an uploaded file, tied to failing to use a separate browser for third-party external actions triggered from PDF documents. The connected docum...
PT-2024-38432 · Alien Technology · Alien Technology Alr-F800
Name of the Vulnerable Software and Affected Versions: Alien Technology ALR-F800 versions up to 19.10.24.00 Description: A critical issue has been found, affecting the function popen of the file /var/www/cgi-bin/upgrade.cgi in the component File Name Handler. The manipulation of the argument...
Alien ALR-F800 操作系统命令注入漏洞
The Alien ALR-F800 is an RFID sensor from Alien. An operating system command injection vulnerability exists in the Alien ALR-F800 version 19.10.24.00 and prior versions, which stems from the uploadedFile parameter in the /admin/system.html file containing an operating system command injection...
Alien ALR-F800 操作系统命令注入漏洞
The Alien ALR-F800 is an RFID sensor from Alien. An operating system command injection vulnerability exists in the Alien ALR-F800 version 19.10.24.00 and prior versions, which stems from an operating system command injection vulnerability contained in the uploadedFile parameter in the File Name...
CVE-2024-37675
CVE-2024-37675 is a Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x. The issue allows a remote attacker to execute arbitrary code via the sectionContent parameter used when adding notes to an uploaded file. The vulnerability is documented with CVSS 3.1: Networ...
CVE-2024-37675
Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via the parameter "sectionContent" related to the functionality of adding notes to an uploaded file...
BIT-SUITECRM-2024-36415 SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution
SuiteCRM is an open-source Customer Relationship Management CRM software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file verification in products allows for remote code execution. Versions 7.14.4 and 8.6.1 contain a fix for this issue...
CVE-2024-36415 SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution
SuiteCRM is an open-source Customer Relationship Management CRM software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file verification in products allows for remote code execution. Versions 7.14.4 and 8.6.1 contain a fix for this issue...
PT-2024-26982 · Suitecrm · Suitecrm
Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.14.4 SuiteCRM versions prior to 8.6.1 Description: The issue is related to a vulnerability in uploaded file verification in products, which allows for remote code execution. This is a critical issue that can be...
CVE-2024-36415: Improper Control of Filename for Include/Require Statement in PHP Program
SuiteCRM is an open-source Customer Relationship Management CRM software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file verification in products allows for remote code execution. Versions 7.14.4 and 8.6.1 contain a fix for this issue...
CVE-2024-34832
CVE-2024-34832 is a directory traversal vulnerability in CubeCart v6.5.5 and earlier that enables arbitrary code execution via crafted uploads to the _g and node parameters. Multiple sources describe the flaw: the admin panel can be abused to include .inc.php files located anywhere on the server,...
Contao 安全漏洞
Contao is an open source content management system CMS developed in PHP. The system supports search engines, rights management, and CSS frameworks. A security vulnerability exists in Contao version 4.x prior to version 4.13.40 and version 5.x prior to version 5.3.4, which stems from the fact that...
CVE-2024-1794: Improper Neutralization of Input During Web Page Generation
The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file e.g. 3gpp file in all versions up to, and including, 1.29.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...
Forminator < 1.29.1 - Unauthenticated Stored XSS
Description The plugin is vulnerable to Stored Cross-Site Scripting via an uploaded file e.g. 3gpp file due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user...
Wallos < 1.11.2 - File Upload RCE
Exploit Title: Wallos - File Upload RCE Authenticated Date: 2024-03-04 Exploit Author: [email protected] Vendor Homepage: https://github.com/ellite/Wallos Software Link: https://github.com/ellite/Wallos Version: -----------------------------29251442139...