EUVD-2018-20502

Malware in sbrugna...

Withdrawn Advisory: Open WebUI Allows Arbitrary File Write via the `/models/upload` Endpoint

Withdrawn Advisory This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references. Original Description In open-webui version 0.3.8, the endpoint /models/upload is vulnerable to arbitrary file write due to improper...

CVE-2023-20272: Improper Protection of Alternate Path

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of the application. This vulnerability is due to insufficient file input validation. An attacker could exploit this...

Cisco Identity Services Engine Arbitrary File Write (cisco-sa-ise-mult-j-KxpNynR)

According to its self-reported version, Cisco Identity Services Engine is affected by an arbitrary file write vulnerability that can be exploited by a remote, authenticated attacker due to insufficient file input validation. Please see the included Cisco BIDs and Cisco Security Advisory for more...

Input validation

Multiple Services such as VHSVideo History Server and VCDVideo Clip Distributor and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker could read sensitive files from the filesyst...

Cisco Enterprise NFV Infrastructure Software Cross-Site Scripting Vulnerability

Cisco Enterprise NFV Infrastructure Software is a lightweight virtualization platform that integrates complete VM lifecycle management, monitoring, device programmability, and service chaining in one installable package. A cross-site scripting vulnerability exists in the Web portal framework of...