PrestaShop file deletion via attachment API

Impact It is possible to delete a file from the server by using the Attachments controller and the Attachments API. Patches 8.1.1 Found by Kto94 via Yeswehack Workarounds none References none...

thunderbird: File Extension Spoofing using the Text Direction Override Character

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...

Atlassian Confluence 7.14.x < 7.19.9 Read Only User Attachment Uploads

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.13.17, 7.14.0 prior to 7.19.9 or 7.20 prior to 8.2.2. It is, therefore, affected by a flaw which permits remote attackers with read only permissions to a page to upload...

Atlassian Confluence 7.20.x < 8.2.2 Read Only User Attachment Uploads

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.13.17, 7.14.0 prior to 7.19.9 or 7.20 prior to 8.2.2. It is, therefore, affected by a flaw which permits remote attackers with read only permissions to a page to upload...

Atlassian Confluence < 7.13.17 Read Only User Attachment Uploads Service

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.13.17, 7.14.0 prior to 7.19.9 or 7.20 prior to 8.2.2. It is, therefore, affected by a flaw which permits remote attackers with read only permissions to a page to upload...

Slackware Linux 15.0 / current mozilla-thunderbird Vulnerability (SSA:2023-212-01)

The version of mozilla-thunderbird installed on the remote host is prior to 102.13.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-212-01 advisory. - Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be...

Debian DSA-5463-1 : thunderbird - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5463 advisory. - Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fa...

CVE-2023-3417

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...

CVE-2023-3417

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...

CVE-2023-3417

CVE-2023-3417 affects Mozilla Thunderbird. The issue arises from the Text Direction Override Unicode Character in filenames, which could cause an email attachment to appear as a non-executable document when it was actually an executable. Affected: Thunderbird versions before 115.0.1 and before 10...

CVE-2023-3417 File Extension Spoofing using the Text Direction Override Character

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...

CVE-2023-3417

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...

CVE-2023-38060

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue...

CVE-2023-38060 Host header injection by attachments in web service

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue...

CVE-2023-38060 Host header injection by attachments in web service

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue...

OTRS 注入漏洞

OTRS is an application from OTRS Germany. A service management software. A security vulnerability exists in OTRS versions 7.0.X prior to 7.0.45 and 8.0.X prior to 8.0.35, which stems from the presence of an incorrect input validation vulnerability that allows any authenticated attacker to perform...

harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks

A vulnerability was found HarfBuzz. This flaw allows attackers to trigger On^2 growth via consecutive marks during the process of looking back for base glyphs when attaching marks...

Mallox Ransomware Exploits Weak MS-SQL Servers to Breach Networks

Mallox ransomware activities in 2023 have witnessed a 174% increase when compared to the previous year, new findings from Palo Alto Networks Unit 42 reveal. "Mallox ransomware, like many other ransomware threat actors, follows the double extortion trend: stealing data before encrypting an...

harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks

A vulnerability was found HarfBuzz. This flaw allows attackers to trigger On^2 growth via consecutive marks during the process of looking back for base glyphs when attaching marks...

harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks

A vulnerability was found HarfBuzz. This flaw allows attackers to trigger On^2 growth via consecutive marks during the process of looking back for base glyphs when attaching marks...