CVE-2024-25274

An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-25274

An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file...

Novel-Plus Security Vulnerability

Novel-Plus is an online social reading and writing platform from Novel-Plus, Inc. A security vulnerability exists in Novel-Plus version v4.3.0-RC1, which stems from allowing the upload of arbitrary files. An attacker could exploit the vulnerability to execute arbitrary code by uploading specially...

CVE-2024-25274

An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-25274: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-25274

Novel-Plus version v4.3.0-RC1 is susceptible to an arbitrary file upload vulnerability within the /sysFile/upload component. This flaw allows an attacker to upload a specially crafted file, leading to arbitrary code execution . To mitigate this risk, it is recommended to disable the /sysFile/uplo...

PT-2024-20854 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus version 4.3.0-RC1 Description: The issue is related to an arbitrary file upload vulnerability in the component /sysFile/upload. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file...

ai.catboost:catboost-spark_3.3_2.12 (>=1.1, <=1.2.10), ai.catboost:catboost-spark_3.3_2.13 (>=1.1.1, <=1.2.10) +18918 more potentially affected by CVE-2024-26308 via org.apache.commons:commons-compress (>=1.21, <=1.25.0)

org.apache.commons:commons-compress MAVEN version =1.21, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.3.5, =0.3.3, =0.3.3, =0.1.12, =0.1.2, =0.18.0, =0.26.0 and more Source cves: CVE-2024-26308 Source advisory: OSV:GHSA-4265-CCF5-PHJ5...

ai.catboost:catboost-spark_3.3_2.12 (>=1.1, <=1.2.10), ai.catboost:catboost-spark_3.3_2.13 (>=1.1.1, <=1.2.10) +18918 more potentially affected by CVE-2024-26308 via org.apache.commons:commons-compress (>=1.21, <=1.25.0)

org.apache.commons:commons-compress MAVEN version =1.21, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.3.5, =0.3.3, =0.3.3, =0.1.12, =0.1.2, =0.18.0, =0.26.0 and more Source cves: CVE-2024-26308 Source advisory: GHSA-4265-CCF5-PHJ5...

Novel-Plus Arbitrary File Upload Vulnerability

Novel-Plus is a multi-end PC, WAP reading, fully functional novel CMS system. Novel-Plus com.java2nb.common.controller.FileController: upload processing fieName parameter there is an arbitrary file upload vulnerability, a remote attacker can use the vulnerability to submit a special request, you...

Medium: jetty

Issue Overview: Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the + character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reje...

CVE-2024-21775

Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature...

CVE-2024-21775

Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature...

Sql injection

Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature...

CVE-2024-21775 SQL Injection

Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature...

CVE-2024-21775 SQL Injection

Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature...

CVE-2024-21775

CVE-2024-21775 affects Zoho ManageEngine Exchange Reporter Plus (versions 5714 and below). The vulnerability is an Authenticated SQL injection in the report exporting feature caused by improper handling in the exporting workflow. Impact as described: high confidentiality, integrity, and sometimes...

PT-2024-19049 · Zoho · Zoho Manageengine Exchange Reporter Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Exchange Reporter Plus versions 5714 and below Description: The issue is related to an Authenticated SQL injection in the report exporting feature. Recommendations: For Zoho ManageEngine Exchange Reporter Plus versions 5714...

CVE-2024-21775: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature...

NGINX QUIC DoS

The vulnerability of HTTP/3 QUIC in NGINX Plus and NGINX OSS web servers is related to the swapping of the zero pointer. Exploiting this vulnerability allows a malicious actor to cause service interruptions by sending specially crafted requests...