3DPrint < 3.5.6.9 - CSRF to arbitrary file downlad

Description The plugin does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into...

Information disclosure

Access of memory location after end of buffer issue exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted V8 file may lead to information disclosure and/or arbitrary code execution...

CVE-2023-32270

Access of memory location after end of buffer issue exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted V8 file may lead to information disclosure and/or arbitrary code execution...

QuickJob Portal 6.1 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

GHSA-JQXR-VJVV-899M @keystone-6/auth Open Redirect vulnerability

Summary There is an open redirect in the @keystone-6/auth package, where the redirect leading / filter can be bypassed. Impact Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. Mitigations - Don't u...

CVE-2023-30179

CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection SSTI. An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrator...

Design/Logic Flaw

DISPUTED CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection SSTI. An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only...

CraftCMS 代码注入漏洞

CraftCMS is a content management system from CraftCMS, Inc. A code injection vulnerability exists in CraftCMS version 3.7.59, which stems from susceptibility to a server-side template injection SSTI attack, where an attacker can inject a Twig template into the er Photo Location field when the Use...

PT-2023-22567 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: CraftCMS version 3.7.59 Description: The issue concerns Server-Side Template Injection SSTI, where an authenticated attacker can inject Twig Template into the User Photo Location field in User Settings, potentially leading to Remote Code...

CVE-2023-34212

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...

WhosHere Plus. Trilateration vulnerability

WhosHere Plus is a dating app that uses GPS data to recommend users near to each other, based on similar interests. PTP constantly researches the state of privacy and security in apps that use GPS data, because the consequences of poor security and privacy are alarming: Tracking and snooping on a...

Strava heatmap loophole may reveal users' home addresses

Researchers at NC State University have outlined potential privacy issues with popular fitness app Strava which could lead to users' homes being pinpointed. The researchers' findings are detailed in a paper called Heat marks the spot: de-anonymising users' geographical data on the Strava heat map...

PT-2023-8802 · Thruk · Thruk

Name of the Vulnerable Software and Affected Versions: Thruk versions 3.06 and prior Description: The issue concerns a Path Traversal vulnerability in the panorama.pm file, which allows an attacker to upload a file to any folder with write permissions on the affected system. The location paramete...

Trend Micro Apex One Security Agent Untrusted Search Path Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...

Trend Micro Apex One Security Agent Untrusted Search Path Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...

CVE-2023-27881

A user could use the “Upload Resource” functionality to upload files to any location on the disk...

CVE-2023-27881

A user could use the “Upload Resource” functionality to upload files to any location on the disk...

Design/Logic Flaw

A user could use the “Upload Resource” functionality to upload files to any location on the disk...

CVE-2023-27881 PTC Vuforia Studio Unrestricted Upload of File with Dangerous Type

A user could use the “Upload Resource” functionality to upload files to any location on the disk...

CVE-2023-27881

CVE-2023-27881 affects PTC Vuforia Studio. Affected: Vuforia Studio (all versions prior to 9.9). Vulnerability: Unrestricted Upload of File with Dangerous Type via the Upload Resource feature allows a user to upload files to arbitrary locations on disk. Impact: potential unauthorized file placeme...