Apache Superset 跨站脚本漏洞

A cross-site scripting vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation. The vulnerability stems from a failure of the upload data form to properly render user input, which could be exploited by an attacker to cause a cross-sit...

CVE-2022-43718: Improper Neutralization of Input During Web Page Generation

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0...

CVE-2022-23026

On BIG-IP ASM & Advanced WAF version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, an authenticated user with low privileges, such as a guest, can upload data using an undisclosed REST endpoint causing an increase in disk resource...

CVE-2020-23995

An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload...

CVE-2020-23995

An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload...

Information disclosure

An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload...

CVE-2020-23995

An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload...

CVE-2020-23995: Generation of Error Message Containing Sensitive Information

An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload...

PT-2021-10994 · Ilias · Ilias

Name of the Vulnerable Software and Affected Versions: ILIAS versions prior to 5.3.19 ILIAS versions prior to 5.4.12 ILIAS versions prior to 6.0 Description: An information disclosure issue allows remote authenticated attackers to obtain the upload data path via a workspace upload. Recommendation...

CVE-2019-16932

A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data...

CVE-2019-16932

A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data...

Server side request forgery (ssrf)

A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data...

CVE-2019-16932

A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data...

CVE-2019-16932: Server-Side Request Forgery (SSRF)

A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data...

PT-2019-14878

Name of the Vulnerable Software and Affected Versions Visualizer plugin versions prior to 3.3.1 for WordPress Description A blind SSRF issue exists in the Visualizer plugin for WordPress. The issue can be exploited via the "wp-json/visualizer/v1/upload-data" API endpoint. Recommendations For...

Visualizer < 3.3.1 - Blind Server-Side Request Forgery (SSRF)

This plugin suffers from a blind SSRF vulnerability in the /wp-json/visualizer/v1/upload-data endpoint. PoC curl -i -s -X $'POST' \ -H $'Host: 192.168.158.128:8000' \ --data-binary $'"url":"http://db:3306"' \ $'http://192.168.158.128:8000/wp-json/visualizer/v1/upload-data' See the references...

Glory Global RBW-100 Code Issue Vulnerability

The Glory Global RBW-100 is a bill collection device from Glory Global USA. A code issue vulnerability exists in the Glory Global RBW-100. An attacker could exploit the vulnerability to upload submitted data and execute code under their control on the file system...

CVE-2018-0500

A heap-based buffer overflow has been found in the Curlsmtpescapeeob function of curl. An attacker could exploit this by convincing a user to use curl to upload data over SMTP with a reduced buffer to cause a crash or corrupt memory...

UBUNTU-CVE-2016-0757

OpenStack Image Service Glance before 2015.1.3 kilo and 11.0.x before 11.0.2 liberty, when showmultiplelocations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image...

PHP "multipart/form-data" Denial of Service Exploit (Python)

No description provided by source. !/usr/bin/python -- coding: utf-8 -- Author: Eren Turkay eren .-. pardus.org.tr, 2009/11/20 http://www.pardus.org.tr/eng/ Credits: Bogdan Calin from Acunetix Description: Exploit to cause denial of service on any host that runs PHP via temporary file exhaustion...