Cisco Intersight 命令注入漏洞

Cisco Intersight is an application platform from Cisco, Inc. provides a level of intelligent management that enables IT organizations to analyze, simplify, and automate their environments in a more advanced way than previous generations of tools. A security vulnerability exists in the Cisco...

Cross site scripting

Alteryx Server 2022.1.1.42590 does not employ file type verification for uploaded files. This vulnerability allows attackers to upload arbitrary files e.g., JavaScript content for stored XSS via the type field in a JSON document within a PUT /gallery/api/media request...

CVE-2022-28865

An issue was discovered in Nokia NetAct 22 through the Site Configuration Tool website section. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious...

Nokia NetAct 跨站脚本漏洞

Nokia NetAct is a network management system from Nokia of Finland. A security vulnerability exists in Nokia NetAct version 22, which originates from a vulnerability that allows an attacker to change the filename of an uploaded file to include JavaScript code, which is then stored and executed by...

PT-2023-12955 · Nokia · Nokia Netact

Name of the Vulnerable Software and Affected Versions: Nokia NetAct version 22 Description: An issue was discovered in the Site Configuration Tool website section, where a malicious user can change the filename of an uploaded file to include JavaScript code. This code is then stored and executed ...

CVE-2022-28865

CVE-2022-28865 affects Nokia NetAct 22 via the Site Configuration Tool. A malicious user can rename an uploaded file with a JavaScript payload, which is stored and later executed by a victim’s browser. The common delivery method is placing the payload in a URL parameter exposed to victims, using ...

CVE-2023-3722

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier...

CVE-2023-3722 Avaya Aura Device Services Remote Code Execution

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier...

GHSA-CX6H-86XW-9X34 Apache Tomcat - Fix for CVE-2023-24998 was incomplete

The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded...

Cross-site Scripting (XSS)

odoo is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the binary field widget which allows an attackers to inject arbitrary web script via crafted uploaded file names...

Directory listing in multiple endpoints

Description Teampass has directory listing by default for various endpoints that eventually discloses application-specific and user data and files. Proof of Concept Visit the following endpoint without logging in to the application. Sensitive - https://127.0.0.1/includes configs -...

PT-2023-11854 · WordPress · Kali Forms

Name of the Vulnerable Software and Affected Versions: Kali Forms plugin for WordPress versions up to, and including, 2.1.1 Description: The issue arises from the kaliforms form delete uploaded file function lacking privilege or user protections, allowing unauthenticated attackers to delete any...

WordPress Plugin Kali Forms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

Kanboard 信息泄露漏洞

Kanboard is a suite of open source visual task board software. The software has the ability to customize the panels according to the business. An information disclosure vulnerability exists in Kanboard versions prior to 1.2.30, which stems from an insecure direct object reference IDOR vulnerabili...

PT-2023-24596 · Kanboard · Kanboard

Name of the Vulnerable Software and Affected Versions: Kanboard versions prior to 1.2.30 Description: The issue is related to an Insecure direct object reference IDOR vulnerability present in the application's URL parameter. This vulnerability enables any user to read files uploaded by any other...

Information Disclosure

francoisjacquet/rosariosis is vulnerable to Information Disclosure. The vulnerability exists due to the lack of permissions and random generation of file names for uploaded files, which allows an attacker to download files on the system...

Cross-site Scripting (XSS)

concrete5/concrete5 is vulnerable to stored Cross-site Scripting XSS. The vulnerability exists in details.php due to lack of sanitation when adding tags on uploaded files which allows an attacker to inject and execute arbitrary JavaScript...

Siemens SICAM P850 and SICAM P855 Improper Neutralization of Input During Web Page Generation (CVE-2022-29882)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices do not handle uploaded files correctly. An unauthenticated attacker could take advantage of this situation to store an XSS attack, which could - when a legitimate user accesses th...

GHSA-474F-MCJV-PGRM Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names

Concrete CMS previously concrete5 before 9.1 is vulnerable to Stored XSS in uploaded file and folder names...

Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names

Concrete CMS previously concrete5 before 9.1 is vulnerable to Stored XSS in uploaded file and folder names...