6710 matches found
CVE-2024-6740
Openfind's Mail2000 does not properly validate email atachments, allowing unauthenticated remote attackers to inject JavaScript code within the attachment and perform Stored Cross-site scripting attacks...
CVE-2024-6740
Openfind Mail2000 is affected by a Stored XSS vulnerability arising from improper validation of email attachments. An unauthenticated remote attacker can inject JavaScript into an attachment, with the attack executed when the attachment is viewed (stored XSS). Affected product: Openfind Mail2000....
Openfind Mail2000 Cross-Site Scripting Vulnerability
Openfind Mail2000 is a Web-based email system from China's Openfind. A cross-site scripting vulnerability exists in Openfind Mail2000, which originates from not properly validating email attachments, allowing an unauthenticated, remote attacker to inject JavaScript code into the attachments and...
NDIS Filter Driver from Third Party Product on Target Device Interferes with Connection to Provisioning Services
When a Network Driver Interface Specification NDIS filter driver from third party product is installed on the master target device before the image process, a vDisk is not attached and the Provisioning Services agent icon on the system tray shows a red X. This causes an inability to create a new...
Malicious code in sap-attachment (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 95815ed10746591cf48b8f56e89afc6b49826351e2061e30175e5a16168e899a The OpenSSF Package Analysis project identified 'sap-attachment' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...
UBUNTU-CVE-2024-37147
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16...
CVE-2024-37147
GLPI (open-source IT asset/ITIL Service Desk) has a vulnerability (CVE-2024-37147) where an authenticated user can attach a document to any item even without write access. Connected PTSecurity entries describe affected versions as prior to 10.0.16 and indicate the issue stems from improper access...
EUVD-2024-36465
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16...
PT-2024-5861 · Glpi +2 · Glpi +2
Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.16 Description: The issue is related to incorrect access control in the GLPI system, which provides ITIL Service Desk features, licenses tracking, and software auditing. An authenticated user can attach a document ...
CVE-2024-3608 Product Designer <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the productdesignerajaxdeleteattachid function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary...
WordPress Product Designer plugin <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion vulnerability
Missing Authorization to Unauthenticated Arbitrary Attachment Deletion vulnerability discovered by Lucio Sá in WordPress Plugin Product Designer versions = 1.0.33...
WordPress Attachment File Icons (AF Icons) plugin <= 1.3 - Cross-Site Request Forgery to Arbitrary File Upload vulnerability
Cross-Site Request Forgery to Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Attachment File Icons versions = 1.3...
PT-2024-26888 · WordPress · Product Designer
Name of the Vulnerable Software and Affected Versions: Product Designer plugin for WordPress versions up to, and including, 1.0.33 Description: The issue is related to a missing capability check on the product designer ajax delete attach id function, which allows unauthorized loss of data. This...
WordPress plugin Attachment File Icons security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress plugin Product Designer security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress Attachment File Icons Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)
Software Attachment File Icons Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-6309 Patch priority Low CVSS severity Low 9.6 Developer Claim ownership PSID c3b98b264536 Credits István Márton...
CVE-2024-39929
Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mimefilename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users...
CVE-2024-39929
Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mimefilename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users...
CVE-2024-39929
Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mimefilename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users...
