1945 matches found
CVE-2024-29795
Technical details about CVE-2024-29795 are not provided in the supplied documents. Monitor vendor advisories and CVE trackers for updates.
CVE-2024-29795 WordPress Media Cloud for Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean Spaces and more plugin <= 4.5.24 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Interfacelab Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more allows Stored XSS.This issue affects Media Cloud for Amazon S3, Imgix, Google Cloud Storage,...
Cross Site Scripting (XSS)
carrierwave is vulnerable to Cross Site Scripting XSS. The vulnerability is due to a flaw in the handling of Content-Type values during file uploads to object storage, such as Amazon S3. The Content-Type validation can be bypassed by providing multiple values separated by commas, which allows...
s3.mediastreaming.it Cross Site Scripting vulnerability OBB-3886976
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained
Impact The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by...
GHSA-VFMV-JFC5-PJJW CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained
Impact The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by...
CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained
Impact The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by...
WordPress Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more Plugin <= 4.5.24 is vulnerable to Cross Site Scripting (XSS)
Software Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more Type Plugin Vulnerable versions = 4.5.24 Fixed in 4.5.25 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29795 Patch priority Low CVSS severity Low 6.5 Developer Claim...
CVE-2024-29034
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value tha...
CVE-2024-29034
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value tha...
CVE-2024-29034 CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value tha...
CVE-2024-29034 CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value tha...
CVE-2024-29034
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value tha...
CVE-2024-29034 CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value tha...
CVE-2024-29034
CVE-2024-29034 affects CarrierWave (Rails/Sinatra file uploads). The issue arises from a Content-Type allowlist bypass when uploading to object storage (e.g., S3): multiple comma-separated values can bypass the allowlist, enabling possible XSS. The vulnerability references CVE-2023-49090 and is a...
CVE-2024-28823
Amazon AWS aws-js-s3-explorer aka AWS JavaScript S3 Explorer 1.0.0 allows XSS via a crafted S3 bucket name to index.html...
CVE-2024-28823
Amazon AWS aws-js-s3-explorer aka AWS JavaScript S3 Explorer 1.0.0 allows XSS via a crafted S3 bucket name to index.html...
CVE-2024-28823
CVE-2024-28823 affects Amazon AWS aws-js-s3-explorer (1.0.0) . The vulnerability allows XSS when an attacker uses a crafted S3 bucket name that targets the explorer’s index.html. The root cause is a cross-site scripting vector via user-controlled bucket names, enabling execution of malicious scri...
PT-2024-22591 · Amazon Aws · Aws-Js-S3-Explorer
Name of the Vulnerable Software and Affected Versions: Amazon AWS aws-js-s3-explorer aka AWS JavaScript S3 Explorer version 1.0.0 Description: The issue allows for XSS via a crafted S3 bucket name to index.html. This can be exploited when a user interacts with a maliciously named S3 bucket,...