Cross-Site Scripting (XSS)

laravel/laravel is vulnerable to cross-site scripting. The vulnerability exists due to the lack of validation in image uploading, allowing an attacker to inject and execute malicious javascript...

Cross-site Scripting (XSS) - DOM in janeczku/calibre-web

Description It is possible to execute XSS payloads when editing book properties, such as uploading a cover or a format. Proof of Concept The file editbooks.js contains the following code: $"btn-upload-cover".on"change", function var filename = $this.val; if filename.substring3, 11 === "fakepath"...

[SECURITY] Fedora 35 Update: curl-7.79.1-1.fc35

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

[SECURITY] Fedora 33 Update: libzapojit-0.0.3-19.fc33

GLib/GObject wrapper for the OneDrive and Hotmail REST APIs. It supports OneDrive file and folder objects, and the following OneDrive operations: - Deleting a file, folder or photo. - Listing the contents of a folder. - Reading the properties of a file, folder or photo. - Uploading files and phot...

CVE-2021-41568 Tad Web - Improper Authorization

Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and uploading files in the system...

Remote code execution

Integria IMS in its 5.0.92 version is vulnerable to a Remote Code Execution attack through file uploading. An unauthenticated attacker could abuse the AsyncUpload function in order to exploit the vulnerability...

CVE-2021-3832 Integria IMS Remote Code Execution

Integria IMS in its 5.0.92 version is vulnerable to a Remote Code Execution attack through file uploading. An unauthenticated attacker could abuse the AsyncUpload function in order to exploit the vulnerability...

CVE-2021-3832

CVE-2021-3832 affects Integria IMS 5.0.92 and exposes a Remote Code Execution vulnerability via the AsyncUpload() function, granting unauthenticated network-accessible attackers full code execution through file uploads. The issue is rooted in the upload handling, enabling an attacker to abuse the...

PT-2021-22037

Name of the Vulnerable Software and Affected Versions: Integria IMS version 5.0.92 Description: The issue allows for a Remote Code Execution attack through file uploading. An unauthenticated attacker could exploit this by abusing the AsyncUpload function. Recommendations: For Integria IMS version...

Traffic Offense Management System 1.0 SQL Injection / Remote Code Execution

Exploit Title: Traffic Offense Management System 1.0 - SQLi to Remote Code Execution RCE Unauthenticated Date: 19.08.2021 Exploit Author: Tagoletta Tağmaç Software Link: https://www.sourcecodester.com/php/14909/online-traffic-offense-management-system-php-free-source-code.html Version: 1.0 Tested...

Traffic Offense Management System 1.0 - SQL Injection to Remote Code Execution Exploit

Exploit Title: Traffic Offense Management System 1.0 - SQLi to Remote Code Execution RCE Unauthenticated Exploit Author: Tagoletta Tağmaç Software Link: https://www.sourcecodester.com/php/14909/online-traffic-offense-management-system-php-free-source-code.html Version: 1.0 Tested on: Linux import...

CVE-2021-34066

An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file...

Simple Image Gallery 1.0 - Remote Code Execution (Unauthenticated) Exploit

Exploit Title: Simple Image Gallery 1.0 - Remote Code Execution RCE Unauthenticated Exploit Author: Tagoletta Tağmaç Software Link: https://www.sourcecodester.com/php/14903/simple-image-gallery-web-app-using-php-free-source-code.html Version: V 1.0 Tested on: Ubuntu import requests import random...

CVE-2021-37547

In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made...

CVE-2021-37547

In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made...

CVE-2021-37547

CVE-2021-37547 affects JetBrains TeamCity prior to version 2020.2.4, due to insufficient checks during file uploading. Root cause: inadequate validation when uploading files in TeamCity. Impact described in sources as a vulnerability with low attack complexity and network access, no authenticatio...

CVE-2021-37547: Undefined Security Weakness

In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made...

PT-2021-21706

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2020.2.4 Description The issue is related to insufficient checks during file uploading. Recommendations For versions prior to 2020.2.4, update to version 2020.2.4 or later to resolve the issue...

Sourcegraph 信息泄露漏洞

Sourcegraph is an open source code search and navigation tool from Sourcegraph, Inc. in the United States. Sourcegraph suffers from a security vulnerability that stems from the fact that the site administration area can be accessed by a normal user, with all information and functionality properly...

[SECURITY] Fedora 34 Update: curl-7.76.1-7.fc34

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...