9297 matches found
PT-2024-26887 · Vaultize · Vaultize
Name of the Vulnerable Software and Affected Versions: Vaultize version 21.07.27 Description: An issue was discovered in the software where there is no check that the filename parameter is correct when uploading files. As a result, a temporary file will be created outside the specified directory...
jetty: Improper addition of quotation marks to user inputs in CgiServlet
A flaw was found in Jetty's CGI servlet which permits incorrect command execution in specific circumstances such as requests with certain characters in requested filenames. This issue could allow an attacker to run permitted commands other than the one requested...
CVE-2024-35081
LuckyFrameWeb v3.5.2 is affected by CVE-2024-35081: an arbitrary file deletion vulnerability exposed through the fileName parameter in the fileDownload method. The issue allows deletion of files and is described as a security vulnerability with high integrity impact (I: high) while confidentialit...
LuckyFrameWeb 安全漏洞
LuckyFrameWeb is an open source testing platform open source by LuckyFrameWeb. A security vulnerability exists in LuckyFrameWeb version v3.5.2, which originates from an arbitrary file deletion via the fileName parameter in the fileDownload method...
PT-2024-26310 · Unknown · Luckyframeweb
Name of the Vulnerable Software and Affected Versions: LuckyFrameWeb version 3.5.2 Description: The issue allows for arbitrary file deletion via the fileName parameter in the fileDownload method. Recommendations: For version 3.5.2, avoid using the fileName parameter in the fileDownload method unt...
TOTOLINK CPE CP450 setUpgradeFW Method Command Injection Vulnerability
TOTOLINK CPE CP450 is an outdoor wireless client terminal device manufactured by China Gion Electronics TOTOLINK. The TOTOLINK CPE CP450 suffers from a command injection vulnerability that stems from the FileName parameter of the setUpgradeFW method failing to properly filter constructor command...
CLSA-2024-1716272273 less: Fix of CVE-2022-48624
CVE-2022-48624: filename.c: shell-quote filenames when invoking LESSCLOSE...
CLSA-2024-1715946971 less: Fix of CVE-2024-32487
CVE-2024-32487: filename.c: quoting mishandling...
OESA-2024-1587 less security update
Less is a pager. A pager is a program that displays text files. Other pagers commonly in use are more and pg. Pagers are often used in command-line environments like the Unix shell and the MS-DOS command prompt to display files. Security Fixes: less through 653 allows OS command execution via a...
OS Command Execution
fuel/core is vulnerable to OS Command Execution. The vulnerability is due to insufficient image filenames validation when constructing the ImageMagick command, which allows specially crafted filenames to be executed as operating system commands...
CVE-2024-34210
TOTOLINK outdoor CPE CP450 v4.1.0cu.747B20191224 was discovered to contain a command injection vulnerability in the CloudACMunualUpdate function via the FileName parameter...
CVE-2024-34210
TOTOLINK outdoor CPE CP450 v4.1.0cu.747B20191224 was discovered to contain a command injection vulnerability in the CloudACMunualUpdate function via the FileName parameter...
CVE-2024-34204
TOTOLINK outdoor CPE CP450 v4.1.0cu.747B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter...
CVE-2024-34204
TOTOLINK outdoor CPE CP450 v4.1.0cu.747B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter...
CVE-2024-32874
Frigate is a network video recorder NVR with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no...
CLSA-2024-1715673753 Fix CVE(s): CVE-2024-32487
SECURITY UPDATE: quoting is mishandled in filename.c. - debian/patches/CVE-2024-32487.patch: Fix bug when viewing a file whose name contains a newline. - CVE-2024-32487...
CLSA-2024-1715673596 less: Fix of CVE-2024-32487
Fix CVE-2024-32487: filename.c: quoting mishandling...
CLSA-2024-1715673429 less: Fix of CVE-2024-32487
Fix CVE-2024-32487: filename.c: quoting mishandling...