8659 matches found
RZK Fortilogger Code Issue Vulnerability
RZK Fortilogger is a system from RZK Turkey that provides instant status tracking, logging, searching/filtering, reporting, and hotspotting for the FortiGate firewall on Windows systems. A security vulnerability exists in FortiLogger 4.4.2.2, which originates from being affected by arbitrary file...
Mozilla Firefox Type Obfuscation Code Execution Vulnerability
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A type confusion vulnerability exists in Mozilla Firefox when using the logical assignment operator, which prevents users from uploading files. No details of the vulnerability are provided at this time...
CVE-2021-22697
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software V2.1.13 and prior that could allow a use-after-free condition which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed...
Mozilla Firefox 安全漏洞
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A type confusion vulnerability exists in Mozilla Firefox when using the logical assignment operator, which prevents users from uploading files. No details of the vulnerability are provided at this time...
Drupal 7.x, 8.x, 9.x Archive_Tar library Vulnerability (SA-CORE-2021-001) - Windows
Drupal is prone to a vulnerability in the ArchiveTar library. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...
Drupal 7.x, 8.x, 9.x Archive_Tar library Vulnerability (SA-CORE-2021-001) - Linux
Drupal is prone to a vulnerability in the ArchiveTar library. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...
DRUPAL-CORE-2021-001
The Drupal project uses the pear Archive\Tar library, which has released a security update that impacts Drupal. For more information please see: CVE-2020-36193 Exploits may be possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them...
Drupal core - Critical - Third-party libraries - SA-CORE-2021-001
The Drupal project uses the pear ArchiveTar library, which has released a security update that impacts Drupal. For more information please see: CVE-2020-36193 Exploits may be possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them...
Wordpress contact-form-7 code issue vulnerability
Wordpress contact-form-7 is a Wordpress Foundation plugin that provides forms for Wordpress. A security vulnerability exists in contact-form-7 aka Contact Form 7 plugin prior to version 5.3.2 that allows unrestricted file uploads and remote code execution because file names may contain special...
PT-2021-11668 · Atlassian · Confluence
Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server and Data Center versions prior to 7.2.0 Description: The issue allows remote attackers to impact the application's availability via a Denial of Service DoS vulnerability in the avatar upload feature. Recommendation...
Theonedev Onedev Code Issue Vulnerability
Theonedev Onedev is a JAVA-based all-in-one DevOps platform from the Theonedev team. The platform supports container build, orchestration, CI, Git management, team collaboration and other features to help developers build a simple, powerful development platform. Theonedev A code issue vulnerabili...
golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS
A flaw was found in the Go standard library packages before upstream versions 1.15 and 1.14.8. Both the net/http/cgi and net/http/fcgi packages use a default Content-Type response header value of "text/html", rather than "text/plain". This flaw allows an attacker to exploit this issue in...
Nagios XI 操作系统命令注入漏洞
Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A remote code execution vulnerability exists in the "Manage Plugins" page in Nagios XI versions prior to 5.8.0. The vulnerability stem...
Open-xchange OX App Suite 跨站脚本漏洞
OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A cross-site scripting vulnerability exists in OX App Suite 7.10.4. An attacker can exploit this vulnerability via a specially crafted Content-Disposition header ...
CVE-2020-23960
Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to 1 approve the mass of the user's comments, 2 restoring a deleted user, 3 installing or running modules, 4 resetting the...
Exploit for Path Traversal in Apache Flink
CVE-2020-17518 Apache Flink RESTful API Arbitrary File Upload...
CVE-2019-18643
Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application. The only protection mechanism is a file-extension blacklist that can be bypassed by adding multiple spaces and periods after the file name. This could allow an attacker to uplo...
CVE-2020-36171
The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads...
