2322 matches found
CVE-2016-2434
CVE-2016-2434...
IIS-ShortName-Scanner
IIS Short Name Scanner - 2012-2023 & Noch immer aktuell... Neuester Vortrag: Beyond Microsoft IIS Short File Name Disclosure Neuester Blogbeitrag: https://soroush.me/blog/2023/07/thirteen-years-on-advancing-the-understanding-of-iis-short-file-name-sfn-disclosure/ Ich empfehle allen, zuerst...
EUVD-2026-67850
External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...
Microsoft Edge (Chromium-based) Spoofing Vulnerability
External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...
CVE-2025-46080
BUGAuthor: yggcwhat Versione interessata: Huocms Fornitore: https://huocms.com/ Indirizzo del codice sorgente: https://gitee.com/digital-flag/huocms File della vulnerabilità: AttachmentController.php Versione interessata： HuoCMS - controller -backend - AttachmentController.php:editFileUrl Il...
IOCScraper
IOC Scraper IOC Scraper utilises IOCPARSER service to fetch IOCs from different vendor Blogs, PDFs, and CSV files. Parsing IOCs is time-consuming process, using current script one can automatically extract and aggregate IOCs easily. Features Defanged IOCs : Supports extracting and defanging IOCs...
CVE-2026-59314
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...
EUVD-2026-67196
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...
CVE-2024-12970
CVE-2024-12970 CVE-2024-12970 descrive una vulnerabilità di OS Command Injection Iniezione di comandi di sistema presente nel software My Computer del sistema operativo Pardus. Questa vulnerabilità consente a un utente di iniettare comandi di sistema tramite il parametro nome file, permettendo co...
EUVD-2026-66827
An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5...
ExtensionSpoofer
ExtensionSpoofer ExtensionSpoofer è un'app desktop Visual Basic .NET che dimostra come nomi di file e icone possano essere manipolati visivamente su Windows mentre il tipo di file eseguibile sottostante rimane invariato. Utilizza il carattere Unicode Right-to-Left Override U+202E per invertire i...
peframe
======= peframe peframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much...
PT-2026-82356
An attacker who can set the file name header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0....
CVE-2026-56136
A flaw was found in NTFS-3G. An out-of-bounds read vulnerability exists that allows a remote attacker to read potentially confidential information within an ntfs-3g process. This can be triggered by crafting a malicious NTFS image and creating a file with a specially crafted name. Mitigation To...
CVE-2026-76158
Datiphy Data Management Center (v8.3.0 through v8.5.1) contains a path traversal vulnerability in its upload API endpoint. An unauthenticated remote attacker can supply relative or absolute path sequences to write files to arbitrary locations outside the intended upload directory, enabling arbitr...
Linux Distros Unpatched Vulnerability : CVE-2026-72847
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call...
CVE-2025-14602
vsDesk generates uploaded file names using a predictable timestamp-based method, allowing remote attackers to guess filenames and access uploaded files. Patched in version 14.0101; CVSS 4.0 scores it MEDIUM (5.3). No in-the-wild exploitation reported. Patch available from https://vsdesk.ru/. Advi...
CVE-2026-65612 Shell Command Injection in nnn
nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...
EUVD-2026-62277
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...
