14939 matches found
Directus Blind SSRF On File Import
Summary There was already a reported SSRF vulnerability via file import. https://github.com/directus/directus/security/advisories/GHSA-j3rg-3rgm-537h It was fixed by resolving all DNS names and checking if the requested IP is an internal IP address. However it is possible to bypass this security...
CVE-2024-39699: Server-Side Request Forgery (SSRF)
Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file import. It was fixed by resolving all DNS names and checking if the requested IP is an internal IP address. However it is possible to bypass this security...
Directus Security Vulnerabilities
Directus is a real-time Api and application dashboard. It is used to manage Sql database content. A security vulnerability exists in Directus versions prior to 10.9.3, which stems from allowing redirection when importing files from a URL and not checking the URL...
Broken Access Control
TYPO3 is vulnerable to Broken Access Control. The vulnerability is due to regular backend users having access to import functionality that is typically restricted to admin users or users with specific User TSconfig settings enabled options.impexp.enableImportForNonAdminUser...
Insecure Deserialization
typo3/cms is vulnerable to Insecure Deserialization. The vulnerability is due to improper validation of incoming import data in the Import/Export component, which requires a valid backend user account to exploit...
RPM Privilege Escalation
The vulnerability of the RPM package manager RPM in Red Hat Enterprise Linux operating systems stems from the lack of checks for verifying the signature of the dependencies before they are imported. Exploiting this vulnerability can allow an attacker to increase their privileges...
GO-2024-2481 Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature in github.com/0xJacky/Nginx-UI
Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
CVE-2024-5008
In WhatsUp Gold versions released before 2023.1.3, an authenticated user with certain permissions can upload an arbitrary file and obtain RCE using Apm.UI.Areas.APM.Controllers.Api.Applications.AppProfileImportController...
Malicious code in active-admin_import (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in Be.Vlaanderen.Basisregisters.PostalRеgistry.Api.CrаbImport (NuGet)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-4040 Malicious code in Be.Vlaanderen.Basisregisters.GrAr.Imроrt (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in Be.Vlaanderen.Basіsregisters.GrAr.Import.Xunіt (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in Be.Vlaanderen.Basіsregistеrs.AddressRegistrу.Api.CrabImpоrt (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in Be.Vlaandеren.Basisregisters.ParcelRegistrу.Api.CrabImport (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in Be.Vlaandеren.Basisregisters.BuildingRegistrу.Api.CrabImport (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in Be.Vlaandеren.Basіsregisters.PаrcelRegistrу.Api.CrabImport (NuGet)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-4210 Malicious code in Be.Vlaanԁеren.Basіsregisters.GrAr.Import.Xunіt (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in Be.Vlaaոderеn.Basіsregisters.StreetNameRеgistry.Api.CrabImport (NuGet)
--- -= Per source details. Do not edit below this line.=-...