8945 matches found
cve-2020-10977
CVE-2020-10977 GitLab 12.9.0 任意文件读取 目标： 12.9.0 及以下版本 测试版本： GitLab 12.8.1 在最近的一次客户项目中，我在目标上发现了一个 GitLab 实例。我在 Exploit-DB 上找到了一个 PoC，但它使用的是 LDAP 认证，而在此情况下 LDAP 禁用了，所以我编写了这个 Python 脚本，它可以使用 Web 界面进行认证。与原始 PoC 类似，它将创建两个项目、在一个项目中创建一个带有恶意 payload 的 issue，然后将该 issue 从一个项目移动到另一个项目，并自动读取文件内容。...
CVE-2015-4133
CVE-2015-4133 root@kitploit: usage: CVE-2015-4133.py -h --RHOST RHOST --RPORT RPORT -v YEAR MONTH FILE ReFlex Gallery plugin de WordPress = 3.1.3 CVE-2015-4133 PoC. Referencia: https://nvd.nist.gov/vuln/detail/CVE-2015-4133 argumentos posicionales: YEAR subdirectorio de wp-content/uploads MONTH...
CVE-2026-76870: Out-of-bounds Read
Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in the mtdwrite pre-flash validation routine triggered by short firmware uploads. Attackers can upload a truncated firmware image via putfilecgi.c to trigger out-of-bounds reads across main.c, checkimageuuid.c, and...
Astra Linux – Vulnerability in Velocity
An attacker who is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify Velocity templates running Apache...
Astra Linux – Vulnerability in Tomcat9
Path Equivalence: The use of ‘file.Name’ an internal dot notation can lead to Remote Code Execution, information disclosure, or the addition of malicious content to uploaded files via the write-enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-...
CVE-2026-88932
multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...
CVE-2026-88932
multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0 , when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, leaving orphaned files on disk. A remote un...
CVE-2026-88932 multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...
CVE-2026-88932 multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...
CVE-2026-88932 multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...
PT-2026-91122
multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...
GHSA-7GHQ-V6JF-G56C Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
Summary There is a medium severity vulnerability in Traefik's HTTP/3 entry points: the respondingTimeouts settings were not applied to the HTTP/3 request path. readTimeout in particular is on by default at 60s and is documented as bounding the time to read the entire request including its body, b...
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
Impact A vulnerability in multer 2.2.0 allows an attacker to trigger a Denial of Service DoS by aborting or truncating multipart uploads. When using diskStorage, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file...
GHSA-QFVM-CV95-JQJF multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
Impact A vulnerability in multer 2.2.0 allows an attacker to trigger a Denial of Service DoS by aborting or truncating multipart uploads. When using diskStorage, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file...
NPM: multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
NPM: multer vulnerable to Denial of Service via file descriptor leak on aborted uploads vulnerability discovered by ? in WordPress Npm multer versions 2.2.0...
CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
EUVD-2026-72507
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...
CVE-2026-86491
JetBrains YouTrack versions prior to 2026.2.18634 were affected by a stored XSS vulnerability exploitable through project and organization icon uploads . An attacker with high privileges (e.g., an authenticated user with project or organization admin rights) could inject malicious scripts that ex...