9164 matches found
VMware Carbon Black App Control 代码问题漏洞
VMware Carbon Black App Control is an application control product from VMware USA. It is used to lock down servers and critical systems to prevent unwanted changes. A code issue vulnerability exists in VMware Carbon Black App Control, where an attacker with administrative access to the VMware App...
CVE-2022-0888: Unrestricted Upload of File with Dangerous Type
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the /includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious file...
PT-2022-13504 · WordPress · Ninja Forms - File Uploads Extension
Name of the Vulnerable Software and Affected Versions: Ninja Forms - File Uploads Extension WordPress plugin versions up to and including 3.3.12 Description: The issue is related to reflected cross-site scripting due to missing sanitization of the filename parameter found in the...
CVE-2022-0889: Improper Neutralization of Input During Web Page Generation
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the /includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web script...
CVE-2022-0687
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role...
PT-2022-13166 · Gogs · Gogs
Name of the Vulnerable Software and Affected Versions: gogs versions prior to 0.12.6 Description: The issue allows a malicious user to upload a crafted config file into a repository's .git directory to gain SSH access to the server. This affects all installations with repository upload enabled,...
CVE-2022-1003
One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to override certain restricted configurations like EnableUploads...
CVE-2021-45040
The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...
CVE-2021-45040
The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...
CVE-2021-45040
The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...
Design/Logic Flaw
The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...
CVE-2021-45040
The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...
CVE-2022-24072
The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool...
pgAdmin 4 Path Traversal vulnerability
When run in server mode, pgAdmin 4 allows users to store files on the server under individual storage directories. Files such as SQL scripts may be uploaded through the user interface. The URI to which upload requests are made fails to validate the upload path to prevent path traversal techniques...
GHSA-CR8C-972V-RMP3 pgAdmin 4 Path Traversal vulnerability
When run in server mode, pgAdmin 4 allows users to store files on the server under individual storage directories. Files such as SQL scripts may be uploaded through the user interface. The URI to which upload requests are made fails to validate the upload path to prevent path traversal techniques...
showdoc .properties file upload vulnerability (CNVD-2022-20508)
showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 are vulnerable to file uploads, which stem from the lack of effective detection of .properties file extensions in the application's file upload feature. An attacker could use this vulnerabilit...
Cross-Site Scripting (XSS)
getgrav/grav is vulnerable to stored cross-site scripting. The vulnerability exists due to lack of xss validations for uploaded SVG files before they get stored which allows an attacker to inject and execute arbitrary javascript...
Cross-site Scripting in ShowDoc
ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via uploading files with files in .xsd, .asa, and .aspx formats...
GHSA-9FCC-7G44-MXRJ Cross-site Scripting in ShowDoc
ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via uploading files with files in .xsd, .asa, and .aspx formats...
showdoc .shtml file upload vulnerability
showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 are vulnerable to file uploads, which stem from the lack of effective detection of .shtml file extensions in the application's file upload feature. An attacker could use this vulnerability to...