CVE-2024-52793

The Deno Standard Library provides APIs for Deno and the Web. Prior to version 1.0.11, http/file-server's serveDir with showDirListing: true option is vulnerable to cross-site scripting when the attacker is a user who can control file names in the source directory on systems with POSIX file names...

less: OS command injection

An OS command injection flaw was found in Less. Since quoting is mishandled in filename.c, opening files with attacker-controlled file names can lead to OS command execution. Exploitation requires the LESSOPEN environment variable, which is set by default in many common cases...

CVE-2024-32487

The less text file browser (versions through 653) is vulnerable to OS command execution due to improper quoting in the filename.c file. An attacker can trigger command execution by providing a file name containing a newline character . Practical exploitation typically requires the use of attacker...

CVE-2024-32487

less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the...

PT-2019-6064 · Qnap · Qnap Photo Station

Name of the Vulnerable Software and Affected Versions: QNAP Photo Station affected versions not specified Description: This issue allows remote attackers to access or modify system files due to external control of file name or path. It is related to incorrect limitation of the directory path name...