CVE-2021-1467

A vulnerability in Cisco Webex Meetings for Android could allow an authenticated, remote attacker to modify the avatar of another user. This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a crafted request to the Cisco Webex Meetings...

PT-2021-2562 · Cisco · Cisco Webex Meetings

Name of the Vulnerable Software and Affected Versions: Cisco Webex Meetings for Android affected versions not specified Description: A vulnerability in Cisco Webex Meetings for Android could allow an authenticated, remote attacker to modify the avatar of another user. This issue is due to imprope...

CVE-2020-5501

phpBB 3.2.8 allows a CSRF attack that can modify a group avatar...

CVE-2020-5501

phpBB 3.2.8 allows a CSRF attack that can modify a group avatar...

CVE-2020-5501

phpBB 3.2.8 allows a CSRF attack that can modify a group avatar...

Snapchat: [render.bitstrips.com] Stored XSS via an incorrect avatar property value

While modifying an avatar, an attacker has the opportunity to submit XSS payloads as its property values. The resulting png file will return a 500 error with the payload in the response body. The response has a text/html content type, which makes the XSS attack possible. PoC: 1. Go to...

tipask question Answering System 1. 4 upload vulnerability-vulnerability warning-the black bar safety net

user.php the user operation function oneditimg //modify avatar if isset$FILES"Filedata" $uploadtmppath = "data/tmp/"; $fileName = 'bigavatar' . $this-user'uid' . '.' . substr$FILES"Filedata"'name', -3; moveuploadedfile$FILES"Filedata""tmpname", $uploadtmppath . $fileName; //This directly...