CVE-2021-41609

SQL injection in the ID parameter of the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenticated attacker to retrieve data from the application's backend database via boolean-based blind and UNION injection...

CVE-2021-41608

A file disclosure vulnerability in the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenticated attacker to retrieve survey user submitted data by modifying the value of the ID parameter in sequential order beginning from 1...

ClassApps SelectSurvey.NET SQL注入漏洞

Net is a survey software from ClassApps, Inc. built using Microsoft's cutting-edge . A SQL injection vulnerability exists in the ID parameter of the UploadedImageDisplay.aspx endpoint, which can be exploited by an unauthenticated attacker to retrieve data from the application's back-end database...

PT-2022-15679

Name of the Vulnerable Software and Affected Versions SYNEL - eharmony affected versions not specified Description The issue allows an attacker to perform a Directory Traversal attack, which is aimed at gaining unauthorized access to the file system. By manipulating the Name parameter, an attacke...

ClassApps SelectSurvey.NET 安全漏洞

ClassApps SelectSurvey.Net is a survey software from ClassApps USA built using Microsoft's cutting-edge . A security vulnerability in the UploadedImageDisplay.aspx endpoint of ClassApps SelectSurvey.NET before 5.052.000 allows remote, unauthenticated attackers to retrieve survey user-submitted da...

CVE-2020-8968

Parallels Remote Application Server RAS allows a local attacker to retrieve certain profile password in clear text format by uploading a previously stored cyphered file by Parallels RAS. The confidentiality, availability and integrity of the information of the user could be compromised if an...

django: potential directory-traversal via uploaded files

A flaw was found in Django. This flaw allows an attacker to upload specially-named files and exploit a flaw in the MultiPartParser function to traverse directories. The highest threat from this vulnerability is to confidentiality...

django: Potential directory-traversal via uploaded files

A flaw was found in Django. MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal via uploaded files with suitably crafted file names. The highest threat from this vulnerability is to data confidentiality...

CVE-2022-38147 - XSS via uploaded gpx file

More info at https://www.silverstripe.org/download/security-releases/cve-2022-38147...

CVE-2021-40129

A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to submit a SQL query through the CSPC configuration dashboard. This vulnerability is due to insufficient input validation of uploaded files. An attacker...

CVE-2021-40129 Cisco Common Services Platform Collector SQL Injection Vulnerability

A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to submit a SQL query through the CSPC configuration dashboard. This vulnerability is due to insufficient input validation of uploaded files. An attacker...

CVE-2021-40129 Cisco Common Services Platform Collector SQL Injection Vulnerability

A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to submit a SQL query through the CSPC configuration dashboard. This vulnerability is due to insufficient input validation of uploaded files. An attacker...

CVE-2021-40129: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to submit a SQL query through the CSPC configuration dashboard. This vulnerability is due to insufficient input validation of uploaded files. An attacker...

django: potential directory-traversal via uploaded files

A flaw was found in Django. This flaw allows an attacker to upload specially-named files and exploit a flaw in the MultiPartParser function to traverse directories. The highest threat from this vulnerability is to confidentiality...

django: Potential directory-traversal via uploaded files

A flaw was found in Django. MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal via uploaded files with suitably crafted file names. The highest threat from this vulnerability is to data confidentiality...

CVE-2021-43564

An issue was discovered in the jobfair aka Job Fair extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded...

Publify 跨站脚本漏洞

Publify is a simple but full-featured web publishing software. A security vulnerability exists in Publify versions v8.0 through v9.2.4, which can be exploited by attackers to inject malicious JavaScript via an uploaded html file...

TYPO3 信息泄露漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland.TYPO3 has an information disclosure vulnerability that originates from the extension's inability to protect or obfuscate the filename of uploaded files, which can be exploited by ...

PT-2021-16898 · Publify · Publify

Name of the Vulnerable Software and Affected Versions: Publify versions v8.0 through v9.2.4 Description: The issue allows a user with a publisher role to inject and execute arbitrary JavaScript code, enabling stored XSS attacks. This can occur while creating a page or article, potentially through...

PT-2021-23872

Name of the Vulnerable Software and Affected Versions jobfair extension versions prior to 1.0.13 jobfair extension versions 2.x prior to 2.0.2 Description An issue was discovered in the jobfair extension for TYPO3, where the extension fails to protect or obfuscate filenames of uploaded files. Thi...