WordPress azw woocommerce file uploads plugin <= 1.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress azw woocommerce file uploads plugin versions = 1.0.1. Solution No patched version available...

WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin <= 1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin versions = 1.3. Solution No patched version available...

WordPress Protect Uploads with Login – Protect Your Uploads plugin <= 1.8 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Protect Uploads with Login – Protect Your Uploads plugin versions = 1.8. Solution No patched version available...

WordPress Protect Uploads with Login – Protect Your Uploads plugin <= 1.8 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Protect Uploads with Login – Protect Your Uploads plugin versions = 1.8. Solution No patched version available...

WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin <= 1.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin versions = 1.3. Solution No patched version available...

Security fix for the ALT Linux 10 package python3-module-django version 3.2.12-alt1

3.2.12-alt1 built Feb. 25, 2022 Anton Farygin in task 295709 Feb. 20, 2022 Anton Farygin - 3.2.11 - 3.2.12 - Fixes for the following security vulnerabilities: + CVE-2022-22818: Possible XSS via % debug % template tag. + CVE-2022-23833: Denial-of-service possibility in file uploads...

Zfaka 代码问题漏洞

An input validation error vulnerability exists in Zfaka, a free, secure, stable and efficient card issuance system, which stems from the product's backend file upload function that does not validate files. An attacker could cause remote command execution through this vulnerability...

CVE-2022-24984

Forms generated by JQueryForm.com before 2022-02-05 if file-upload capability is enabled allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur on the client side, and because not all executable content...

Bbs Forum 代码问题漏洞

Bbs Forum Patrol Cloud Light Forum System is a forum system. A code issue vulnerability exists in BBS Forum, which originates from the product's getType function not performing security checks on uploaded files. An attacker can use this vulnerability to upload arbitrary files. The following...

CVE-2020-13675

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the si...

Projeqtor 安全漏洞

Projeqtor is a PHP-based open source project management software from the Projeqtor community. The software is used to organize various functions required for multiple projects and is suitable for IT projects. A cross-site scripting vulnerability exists in Projeqtor 9.3.1 that allows an attacker ...

Apache Cayenne 代码问题漏洞

Apache Cayenne is the United States Apache Apache Foundation of an open source persistence framework licensed under the Apache license . Used to provide object-relational mapping and teleprocessing services. An input validation error vulnerability exists in Apache Cayenne because the product does...

GHSA-G4GM-PXH3-29FQ Unrestricted Uploads in Concrete5

Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value...

Unrestricted Uploads in Concrete5

Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value...

CVE-2021-44912

In XE 1.116, when uploading the Normal button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities. If the .htaccess configuration is...

XpressEngine 跨站脚本漏洞

XpressEngine XE is a CMS Content Management System that allows anyone to publish content easily, conveniently and freely. With an open source license, anyone can use or modify it, and as an open project, anyone can participate in its development. XE suffers from a security vulnerability that stem...

Siemens Comos 代码问题漏洞

Siemens Comos is a plant engineering software solution from Siemens, a German company. A code issue vulnerability exists in Siemens Comos version V10.2, which stems from the COMOS Web component of COMOS allowing the upload and storage of arbitrary files on a Web server. An attacker could exploit...

PT-2022-16140 · Unknown · M1K1O/Blog

Name of the Vulnerable Software and Affected Versions: m1k1o/blog affected versions not specified Description: The issue concerns a lightweight self-hosted PHP blog, where errors from functions imagecreatefrom and image have not been checked properly. Although PHP issued warnings and the upload...

PT-2022-7070 · Unknown · Linuxasmcallgraph

Name of the Vulnerable Software and Affected Versions: LinuxASMCallGraph versions prior to commit 20dba06bd1a3cf260612d4f21547c25002121cd5 Description: The issue is related to incorrect filtering rules of uploaded files, allowing attackers to cause remote code execution on the server side via...

USN-5269-2: Django vulnerabilities

USN-5269-1 fixed several vulnerabilities in Django. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: Keryn Knight discovered that Django incorrectly handled certain template tags. A remote attacker could possibly use this issue to...