577 matches found
PT-2023-26667 · Unknown · Dolibarr Erp/Crm
Name of the Vulnerable Software and Affected Versions: Dolibarr ERP CRM versions 17.0.1 and earlier Description: The issue allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions. Recommendations: For versions 17.0.1 a...
The vulnerability of the umask() function in the archive_write_disk.posix.c component of the Libarchive library, which allows an attacker to delete and rename files within directories.
The vulnerability of the umask function in the archivewritedisk.posix.c component of the Libarchive library arises due to synchronization errors when using a shared resource. Exploiting this vulnerability could allow an attacker to delete and rename files within these directories...
ROS-20230825-03
A vulnerability in the Libarchive library is related to the umask call inside archivewritediskposix.c, which changes the umask of the entire process for a very short period of time, this results in a permanent setting of umask 0, which will cause the hidden creation of a directory with permission...
CVE-2023-4475
An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master ADM allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below...
CVE-2023-4475
An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master ADM allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below...
CVE-2023-4475
ASUSTOR Data Master (ADM) is affected by an Arbitrary File Movement vulnerability via the file renaming feature. Affected: ADM 4.0.6.RIS1 and below, ADM 4.1.0 and below, ADM 4.2.2.RI61 and below. Root cause: exploitation of the file renaming mechanism to move files into unintended directories. Im...
CVE-2023-4475 An Arbitrary File Movement vulnerability was found on the ADM
An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master ADM allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below...
ASUSTOR Data Master 安全漏洞
ASUSTOR Data Master is a proprietary operating system for ASUSTOR NAS from ASUS in China, featuring a tablet-like graphical interface comparable to a zero-learning curve, making it easy to get started right away. A security vulnerability exists in ASUSTOR Data Master, which stems from the presenc...
PT-2023-7490 · Asustor · Asustor Data Master
Name of the Vulnerable Software and Affected Versions: ASUSTOR Data Master ADM versions 4.0.6.RIS1 and below ASUSTOR Data Master ADM versions 4.1.0 and below ASUSTOR Data Master ADM versions 4.2.2.RI61 and below Description: An Arbitrary File Movement issue was found in ASUSTOR Data Master ADM,...
PT-2023-21754 · Wekan · Wekan
Name of the Vulnerable Software and Affected Versions: WeKan versions prior to 6.75 Description: A stored cross-site scripting Stored XSS issue in the file preview feature allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Users with BoardAdmin...
CVE-2023-2684
The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-2684
CVE-2023-2684 affects the WordPress plugin File Renaming on Upload (before 2.5.2). Root cause: the plugin does not sanitize and escape certain settings, enabling stored cross-site scripting by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Impact is...
CVE-2023-2684 File Renaming on Upload < 2.5.2 - Admin+ Stored Cross-Site Scripting
The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2023-20815 · WordPress · File Renaming On Upload
Name of the Vulnerable Software and Affected Versions: File Renaming on Upload WordPress plugin versions prior to 2.5.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...
WordPress Plugin File Renaming on Upload 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
WordPress File Renaming on Upload Plugin < 2.5.2 is vulnerable to Cross Site Scripting (XSS)
Software File Renaming on Upload Type Plugin Vulnerable versions 2.5.2 Fixed in 2.5.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2684 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 40dbdf1fdc55 Credits Hao Huynh My Le...
File Permission Bypass
libarchive.so is vulnerable to File Permission Bypass. The vulnerability exists due to a race condition in archivewritediskheader function at archivewritediskposix.c because the unmasking process does not take intro consideration other threads working on the same file, which allows an attacker to...
HTML Injection
teampass password manager is vulnerable to HTML injection .The vulnerability is due to lack of user input sanitisation while renaming a folder with user supplied folder name resulting in running malicious html when the same folder is accessed by other users including admin...
git: arbitrary configuration injection when renaming or deleting a section from a configuration file
A vulnerability was found in Git. This security flaw occurs when renaming or deleting a section from a configuration file, where certain malicious configuration values may be misinterpreted as the beginning of a new configuration section. This flaw leads to arbitrary configuration injection...
