CVE-2024-52302

CVE-2024-52302: Common-User-Management における無制限ファイルアップロードの脆弱性 概要 私は、動的にユーザーアクセスを制御するように設計されたユーザー管理サービスを備えた堅牢なSpring Bootアプリケーションである common-user-management に、重大なセキュリティ脆弱性を発見しました。この脆弱性は /api/v1/customer/profile-picture エンドポイントに影響し、攻撃者が適切な検証なしにファイルをアップロードできるようにすることで、リモートコード実行 RCE につながる可能性があります。...

EUVD-2026-4194

Malicious code in @alluxio/common-ui npm...

EUVD-2022-43231

Malicious code in bioql PyPI...

CVE-2024-52302

common-user-management is a robust Spring Boot application featuring user management services designed to control user access dynamically. There is a critical security vulnerability in the application endpoint /api/v1/customer/profile-picture. This endpoint allows file uploads without proper...

PT-2024-35165 · Unknown · Common-User-Management

Name of the Vulnerable Software and Affected Versions: common-user-management affected versions not specified Description: The issue concerns a critical security vulnerability in the application endpoint /api/v1/customer/profile-picture, which allows file uploads without proper validation or...

CVE-2024-52302: Unrestricted Upload of File with Dangerous Type

common-user-management is a robust Spring Boot application featuring user management services designed to control user access dynamically. There is a critical security vulnerability in the application endpoint /api/v1/customer/profile-picture. This endpoint allows file uploads without proper...

CVE-2023-25646

There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common user permissions can use this vulnerability to obtain elevated permissions on the affected device by performing specific operations...

CVE-2023-41779

There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission, the physical machine will be crashed...

CVE-2023-41779 Illegal Memory Access Vulnerability of ZTE's ZXCLOUD iRAI

There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission, the physical machine will be crashed...

CVE-2023-41779 Illegal Memory Access Vulnerability of ZTE's ZXCLOUD iRAI

There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission, the physical machine will be crashed...

CVE-2023-41779: Improper Restriction of Operations within the Bounds of a Memory Buffer

There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission, the physical machine will be crashed...

PT-2024-12969 · Zte · Zxcloud Irai

Name of the Vulnerable Software and Affected Versions: ZXCLOUD iRAI affected versions not specified Description: There is an illegal memory access issue in ZTE's ZXCLOUD iRAI product. When exploited by an attacker with common user permission, the physical machine will crash. Recommendations: At t...

NVIDIA GPU Display Driver 缓冲区错误漏洞

NVIDIA GPU Display Driver is a driver software from NVIDIA Corporation that is used for interactive support of graphics card display modules in operating systems. A security vulnerability exists in NVIDIA GPU Display Driver that originates from a common user that could result in an out-of-bounds...

CVE-2022-3895

Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML XSS...

CVE-2022-3895

Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML XSS...

Design/Logic Flaw

Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML XSS...

CVE-2022-3895 Potential XSS in common user interface component library

Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML XSS...

PT-2022-24624 · Unknown · Common User Interface

Name of the Vulnerable Software and Affected Versions: Common User Interface Component affected versions not specified Description: The issue is related to some UI elements of the Common User Interface Component not properly sanitizing output, making them prone to output arbitrary HTML, which can...

CVE-2022-3895: Improper Neutralization of Input During Web Page Generation

Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML XSS...

BlueSpice 跨站脚本漏洞

BlueSpice is free Wiki software from BlueSpice based on the MediaWiki engine. BlueSpice suffers from a cross-site scripting vulnerability that stems from the fact that some of the UI elements of its Common User Interface component are not properly sanitized for output, and are therefore prone to...