GHSA-WRP2-6V6J-HFMG ConcreteCMS vulnerable to Stored Cross-site Scripting

Concrete CMS v9.2.1 is affected by Arbitrary File Upload vulnerability via the Thumbnail file upload, which allows Cross-Site Scripting XSS...

CVE-2023-44763

Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting XSS. NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is one of the...

Cross site scripting

DISPUTED Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting XSS. NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is o...

PT-2023-29287 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS version 9.2.1 Description: The issue allows for Arbitrary File Upload via a Thumbnail file upload, which can lead to Cross-Site Scripting XSS. This is possible even with the default configuration, where 'pdf' is one of the allowe...

CVE-2023-44763

Summary: Concrete CMS v9.2.1 is affected by an arbitrary file upload vulnerability via the Thumbnail upload, enabling Cross-Site Scripting (XSS). The issue stems from insufficient validation/sanitization of uploaded files, allowing malicious content to be stored/executed. Several connected source...

CVE-2023-4616

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The issue results from the lack of proper validati...

Fedora: Security Advisory for ImageMagick (FEDORA-2023-edbdccae2a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-36674

A flaw was found in MediaWiki. When manually setting a thumbnail image for an image embed, the thumbnail image is not checked against the bad file list, allowing it to be embedded...

PT-2023-11668 · Freeimage +1 · Freeimage +1

Name of the Vulnerable Software and Affected Versions: FreeImage version 3.19.0 Description: The issue allows remote attackers to run arbitrary code via the opening of a crafted psd file. This is due to a Buffer Overflow vulnerability in the psdThumbnail::Read function in PSDParser.cpp...

WordPress Embed Video Thumbnail Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Embed Video Thumbnail Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 8566e0ea18cd Credits Rafie Muhammad Patchstack...

WordPress Video Embed & Thumbnail Generator Plugin < 4.8.11 is vulnerable to Cross Site Scripting (XSS)

Software Video Embed & Thumbnail Generator Type Plugin Vulnerable versions 4.8.11 Fixed in 4.8.11 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 593159c2fc96 Credits Rafie Muhammad...

USN-6200-1 imagemagick vulnerabilities

It was discovered that ImageMagick incorrectly handled the "-authenticate" option for password-protected PDF files. An attacker could possibly use this issue to inject additional shell commands and perform arbitrary code execution. This issue only affected Ubuntu 20.04 LTS. CVE-2020-29599 It was...

CVE-2021-4384

The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the loadimagesthumbnail and editgallery functions. This makes it possible for unauthenticat...

CVE-2023-1722

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

CVE-2023-1721

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

CVE-2023-1721

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

CVE-2023-1721

The CVE-2023-1721 entry concerns Yoga Class Registration System v1.0 where an administrator can execute commands on the server due to improper validation of class thumbnails during upload. The related documents repeatedly describe a file-upload vulnerability that, enabled by admin privileges, all...

Yoga Class Registration System 跨站请求伪造漏洞

Yoga Class Registration System is a yoga class registration system by Carlo Montero Personal Developer. A cross-site request forgery vulnerability exists in Yoga Class Registration System version 1.0, which stems from the application failing to properly validate class thumbnails uploaded by an...

PT-2023-17190 · Unknown · Yoga Class Registration System

Name of the Vulnerable Software and Affected Versions: Yoga Class Registration System version 1.0 Description: The issue allows an administrator to execute commands on the server due to the application's failure to correctly validate the thumbnails of the classes uploaded by the administrators...

[SECURITY] Fedora 38 Update: ImageMagick-7.1.1.11-1.fc38

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...