1435 matches found
PT-2024-21318 · Liferay · Liferay Dxp +1
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.4.3.15 Liferay DXP 7.4 before update 16 Liferay DXP 7.3 before update 4 Liferay DXP 7.2 before fix pack 19 Description: The Image Uploader module relies on a request parameter to limit the size of files...
WordPress Add SVG Support for Media Uploader | inventivo Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)
Software Add SVG Support for Media Uploader | inventivo Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7088 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 55730a740706...
Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Author+ Stored XSS via SVG
Description The plugin does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. Upload an SVG with the following code: alert"xss"; Access the uploaded file directly to see the XSS...
Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Author+ Stored XSS via SVG
Description The plugin does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. PoC Upload an SVG with the following code: Access the uploaded file directly to see the XSS...
VulnCheck KEV: CVE-2017-17560
An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multiuploadify.php, provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file...
VulnCheck KEV: CVE-2021-34624
A vulnerability in the file uploader component found in the /src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3...
VulnCheck KEV: CVE-2020-29597
IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This vulnerability allows unauthenticated attackers to upload files into the server...
VulnCheck KEV: CVE-2021-30118
An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management RMM 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload...
GHSA-GXHX-G4FQ-49HJ CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS
Impact CarrierWave::Uploader::ContentTypeAllowlist has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in allowlistedcontenttype? determines Content-Type permissions by performing a partial match. If the contenttype argument of allowlistedcontenttype? is...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the allowlistedcontenttype? function. An attacker can bypass the Content-Type allowlist, potentially leading to the exploitation of this vulnerability by passing a crafted value as the contenttype argument...
CVE-2023-41788 Remote Code Execution via File Uploader
Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allows attackers to execute code via PHP file uploads. This issue affects Pandora FMS: from 700 through 773...
CVE-2023-6102
A vulnerability, which was classified as problematic, was found in Maiwei Safety Production Control Platform 4.1. Affected is an unknown function of the file /Content/Plugins/uploader/FileChoose.html?fileUrl=/Upload/File/Pics/&parent. The manipulation leads to unrestricted upload. It is possible ...
Malicious code in airslate-image-uploader (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 108a6e072252da4d719844c42ffb41e5a8fbb92cbfdd9305086a108dfc14233a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8449 Malicious code in airslate-image-uploader (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 108a6e072252da4d719844c42ffb41e5a8fbb92cbfdd9305086a108dfc14233a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2020-36706
The Simple:Press – WordPress Forum Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /admin/resources/jscript/ajaxupload/sf-uploader.php file in versions up to, and including, 6.6.0. This makes it possible for attackers to upload arbitrary fil...
WordPress Plugin Simple:Press - WordPress Forum Code Issue Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Simple:Press - WordPress...
WordPress File Uploader Plugin < 4.23.3 is vulnerable to Cross Site Scripting (XSS)
Software File Uploader Type Plugin Vulnerable versions 4.23.3 Fixed in 4.23.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4811 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1623a29c06e5 Credits FAIYAZ AHMAD Required...
Researchers Unveil ToddyCat's New Set of Tools for Data Exfiltration
The advanced persistent threat APT actor known as ToddyCat has been linked to a new set of malicious tools that are designed for data exfiltration, offering a deeper insight into the hacking crew's tactics and capabilities. The findings come from Kaspersky, which first shed light on the adversary...
