1482 matches found
CVE-2023-48702 Jellyfin Possible Remote Code Execution via custom FFmpeg binary
Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the /System/MediaEncoder/Path endpoint executes an arbitrary file using ProcessStartInfo via the ValidateVersion function. A malicious administrator can setup a network share and supply a UNC path to...
Improper File Execution
firefox-esr,thunderbird vulnerable to Improper File Execution. The vulnerability due to a file is not present when downloading .msix, .msixbundle, .appx, and .appxbundle files. It allows an attacker could execute a malicious file will effect on windows operating system...
Design/Logic Flaw
Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists that allows an attacker to upload and execute arbitrary files...
CVE-2023-41998
Summary: CVE-2023-41998 affects Arcserve UDP prior to 9.2 via the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine allows uploading and executing arbitrary files, enabling unauthenticated remote exploitation as described in multiple sources. Affected product/version: Arcserv...
Design/Logic Flaw
PKP-WAL aka PKP Web Application Library or pkp-lib before 3.3.0-16, as used in Open Journal Systems OJS and other products, does not verify that the file named in an XML document used for the native import/export plugin is an image file, before trying to use it for an issue cover image...
PT-2023-10324 · Unknown · Saat Netizen +1
Name of the Vulnerable Software and Affected Versions: SaAT Netizen installer versions 1.2.0.424 and earlier SaAT Netizen versions 1.2.0.8 and earlier Description: The issue allows a remote unauthenticated attacker to conduct a man-in-the-middle attack due to improper file verification. A...
CVE-2023-45799
In MLSoft TCO!stream versions 8.0.22.1115 and below, a vulnerability exists due to insufficient permission validation. This allows an attacker to make the victim download and execute arbitrary files...
Input validation
In MLSoft TCO!stream versions 8.0.22.1115 and below, a vulnerability exists due to insufficient permission validation. This allows an attacker to make the victim download and execute arbitrary files...
CVE-2023-45799
MLSoft TCO!stream ≤8.0.22.1115 is affected by a vulnerability due to insufficient permission validation, enabling an attacker to cause the victim to download and execute arbitrary files. The connected documents consistently identify the affected product/versions and the core cause but do not prov...
PT-2023-29313 · WordPress · Dropbox Folder Share
Name of the Vulnerable Software and Affected Versions: Dropbox Folder Share for WordPress versions up to, and including, 1.9.7 Description: The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the editor-view.php file. This enables the execution of a...
Design/Logic Flaw
web\ViewAction in Yii aka Yii2 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter...
CVE-2015-5467
web\ViewAction in Yii aka Yii2 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter...
CVE-2015-5467
web\ViewAction in Yii aka Yii2 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter...
Yii Path Traversal Vulnerability
Yii is a component-based, high-performance PHP framework for developing large-scale web applications developed by the YII team. A security vulnerability exists in Yii before version 2.0.5, which can be exploited to execute any local .php file via webViewAction...
The vulnerability of the Redmine project and task management web application, related to improper handling of exceptional states, allows a hacker to upload and execute any file they desire.
The vulnerability of the Redmine project and task management web application lies in the improper handling of exceptional states. Exploiting this vulnerability allows a malicious actor to remotely upload and execute any file they desire...
CVE-2023-2453
CVE-2023-2453 affects PHPFusion. The issue is insufficient sanitization of tainted file names directly concatenated with a path and passed to a require_once statement, allowing inclusion and execution of arbitrary .php files when the absolute path is known. The description notes there is no known...
CVE-2023-2453 Local file Inclusion (LFI) in Forum Infusion via Directory Traversal
There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘requireonce’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known...
PHPFusion Security Vulnerability
PHPFusion is a Malaysian PHPFusion company based on MySql and PHP open source lightweight content management system . The system contains modules for news, articles and forums. A security vulnerability exists in PHPFusion that stems from inadequate cleanup of tainted filenames, allowing the...
JVN#92720882: Multiple vulnerabilities in CGIs of PMailServer and PMailServer2
CGIs included with PMailServer and PMailServer2 provided by A.K.I Software contain multiple vulnerabilities listed below. Stored cross-site scripting vulnerability CWE-79 - CVE-2023-39223 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N| Base Score: 5.4 CVS...