CVE-2024-32731

SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker can upload a malicious attachment to a business trip request which will lead to a low impact on the confidentiality,...

BIT-ELASTICSEARCH-2024-23449 Elasticsearch Uncaught Exception

An uncaught exception in Elasticsearch = 8.4.0 and 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypte...

CVE-2024-32731 Missing Authorization check in SAP My Travel Requests

SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker can upload a malicious attachment to a business trip request which will lead to a low impact on the confidentiality,...

CVE-2024-32731

SAP My Travel Requests contains a privilege-escalation vulnerability due to missing authorization checks for authenticated users. Exploitation could allow an attacker to upload a malicious attachment to a business trip request, with low impact on confidentiality, integrity and availability as des...

PT-2024-24818 · Sap · Sap My Travel Requests

Name of the Vulnerable Software and Affected Versions: SAP My Travel Requests affected versions not specified Description: The issue is related to insufficient authorization checks for authenticated users, leading to potential escalation of privileges. An attacker can exploit this to upload a...

Genie Path Traversal vulnerability via File Uploads

Overview Path Traversal Vulnerability via File Uploads in Genie Impact Any Genie OSS users running their own instance and relying on the filesystem to store file attachments submitted to the Genie application may be impacted. Using this technique, it is possible to write a file with any...

Cross-Site Scripting

libSOGo.so is vulnerable to Cross-Site Scripting. The vulnerability is due to inadequate sanitization during attachment preview. This allows an attacker to execute arbitrary JavaScript code within the context of the user's browser session...

CVE-2021-35002

BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of...

PT-2024-20974 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: A SQL injection issue was discovered via the attach id parameter at the "/Bulletin/AttachDownLoad.aspx" API endpoint. This allows for potential exploitation. Recommendations: For versions 6.01...

CVE-2024-25507

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the emailattachid parameter at /LHMail/AttachDown.aspx...

CVE-2024-23188

Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interaction is required for the vulnerability to trigger. Attackers could perform malicious API requests or extract information from the users...

CVE-2024-23188

CVE-2024-23188 affects Open-Xchange App Suite; multiple connected sources describe a vulnerability where maliciously crafted E‑mail attachment names can temporarily execute script code in a user’s browser session, with common user interaction required. The Open-Xchange-related entries indicate af...

[SECURITY] Fedora 40 Update: clamav-1.0.6-1.fc40

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

[SECURITY] Fedora 38 Update: clamav-1.0.6-1.fc38

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

[SECURITY] Fedora 39 Update: clamav-1.0.6-1.fc39

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

DEBIAN-CVE-2024-34462

Alinto SOGo through 5.10.0 allows XSS during attachment preview...

CVE-2024-34462

Alinto SOGo through 5.10.0 allows XSS during attachment preview...

UBUNTU-CVE-2024-34462

Alinto SOGo through 5.10.0 allows XSS during attachment preview...

PT-2024-25916

Name of the Vulnerable Software and Affected Versions Alinto SOGo versions through 5.10.0 Description The issue allows for XSS during attachment preview. Recommendations For versions through 5.10.0, update to a version later than 5.10.0 to resolve the issue. At the moment, there is no information...

SOGo 安全漏洞

SOGo is a very fast and extensible modern collaboration suite. It provides calendaring, address book management and a full-featured Webmail client as well as resource sharing and permission handling. A security vulnerability exists in Alinto SOGo 5.10.0 and prior versions that originates from...