Import XML and RSS Feeds < 2.1.6 - Authenticated (Administrator+) Arbitrary File Upload

Description The Import XML and RSS Feeds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the moovesetfeaturedimage function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with administrator-level...

CVE-2024-27346

CVE-2024-27346 concerns a vulnerability in Kofax Power PDF related to the parsing of PDF files. The flaw is a failure to validate user-supplied data, causing a read past the end of an allocated buffer in the PDF handling code, which can lead to an information disclosure . Some sources note that a...

File Validation Bypass

ezsystems/ezplatform-kernel is vulnerable to File Validation Bypass. The vulnerability is due to improper file validation, which allows an attacker to save article content even if its rejected during validation...

File Validation Bypass

ibexa/core is vulnerable to File Validation Bypass. The vulnerability is due to inadequate file type validation within the validate function in FileExtensionBlackListValidator.php. When attempting to publish content with rejected file types, the validation fails which does prevent publication, bu...

GHSA-9J39-4686-M3C4 Ibexa Kernel's files with blacklisted extensions can be still saved to drafts

Impact File validation can be configured to reject certain files by file type. When this happens, validation fails, and the content can't be published. However, the file can be saved when saving the content draft. This means unwanted files can be present in storage, even if they are not easily...

Ibexa Kernel's files with blacklisted extensions can be still saved to drafts

Impact File validation can be configured to reject certain files by file type. When this happens, validation fails, and the content can't be published. However, the file can be saved when saving the content draft. This means unwanted files can be present in storage, even if they are not easily...

GHSA-MWVH-P3HX-X4GG Ibexa Kernel's files with blacklisted extensions can be still saved to drafts

Impact File validation can be configured to reject certain files by file type. When this happens, validation fails, and the content can't be published. However, the file can be saved when saving the content draft. This means unwanted files can be present in storage, even if they are not easily...

Ibexa Kernel's files with blacklisted extensions can be still saved to drafts

Impact File validation can be configured to reject certain files by file type. When this happens, validation fails, and the content can't be published. However, the file can be saved when saving the content draft. This means unwanted files can be present in storage, even if they are not easily...

CVE-2024-27317

A path traversal vulnerability was found in Apache Pulsar. Pulsar allows authenticated users to upload functions to be run by the Pulsar Function Workers, these codes are in the format of a ZIP file. When extracting the uploaded ZIP file Pulsar fails to properly validate the file names contained ...

GHSA-672R-97R7-VX2Q pretix mishandles file validation

pretix before 2024.1.1 mishandles file validation...

pretix mishandles file validation

pretix before 2024.1.1 mishandles file validation...

CVE-2024-27447

pretix before 2024.1.1 mishandles file validation...

PYSEC-2024-253

pretix before 2024.1.1 mishandles file validation...

PYSEC-2024-253

pretix before 2024.1.1 mishandles file validation...

CVE-2024-27447

pretix before 2024.1.1 mishandles file validation...

CVE-2024-27447

pretix before 2024.1.1 mishandles file validation...

CVE-2024-27447

pretix prior to 2024.1.1 has an improper file validation vulnerability in its upload handling. This misvalidation can affect confidentiality, integrity, and availability, with a CVSS v3.1 base score of 9.8 (CRITICAL) and network attack vector, no user interaction. Public details from connected so...

rami.io pretix security breach

rami.io pretix is a ticket store application for conferences, festivals, concerts, tech events, shows, exhibitions, workshops, bars, etc. from the German company rami.io. A security vulnerability exists in rami.io pretix versions prior to 2024.1.1 that stems from incorrectly handling file...

CVE-2024-27447

pretix before 2024.1.1 mishandles file validation...

PT-2024-21903 · Pretix · Pretix

Name of the Vulnerable Software and Affected Versions: pretix versions prior to 2024.1.1 Description: The issue is related to the mishandling of file validation. Recommendations: For versions prior to 2024.1.1, update to version 2024.1.1 or later to resolve the issue...