Vtenext 安全漏洞

Vtenext is a Customer Relationship Management system from the Italian company Vtenext that helps users manage the CRM process in their business activities. A security vulnerability exists in Vtenext version 21.02, which arises from the application's failure to implement proper authentication...

NETGEAR ProSAFE Network Management System File Upload Vulnerability

NETGEAR ProSAFE Network Management System is a network management system from NETGEAR for centralized management, monitoring, and configuration of network devices. A file upload vulnerability exists in the NETGEAR ProSAFE Network Management System, which stems from the application's lack of...

Vehicle Management System 代码问题漏洞

Vehicle Management System is a vehicle management system by Warren Daloyan, an individual developer. A code issue vulnerability exists in SourceCodester Vehicle Management System version 1.0, which stems from the parameter file in the file /newvehicle.php that can cause unrestricted uploads...

Remote Code Execution (RCE)

ezsystems/ezpublish-kernel is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of file uploads, which can lead to remote code execution...

IBM Security Guardium Code Issue Vulnerability (CNVD-2024-24727)

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. IBM Security Guardium suffers from a code issue vulnerabili...

PT-2024-26563 · O2Oa · O2Oa

Name of the Vulnerable Software and Affected Versions: O2OA version 8.3.8 Description: The issue allows attackers to execute arbitrary code by uploading a crafted PDF file, exploiting an arbitrary file upload vulnerability. Recommendations: For O2OA version 8.3.8, consider restricting file upload...

CVE-2024-5084

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files ...

CVE-2024-5084 Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files ...

Hash Form – Drag & Drop Form Builder < 1.1.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution

Description The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload...

PT-2024-4070 · Unknown · Spring Cloud Data Flow

Name of the Vulnerable Software and Affected Versions: Spring Cloud Data Flow affected versions not specified Description: The issue is related to improper sanitization for upload paths in the Skipper server, allowing a malicious user with access to the server API to write arbitrary files to any...

NETGEAR ProSAFE Network Management System 安全漏洞

NETGEAR ProSAFE Network Management System is a network management system from NETGEAR for centralized management, monitoring, and configuration of network devices. A file upload vulnerability exists in the NETGEAR ProSAFE Network Management System, which stems from the application's lack of...

CVE-2024-33529

ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to execute operating system commands via file uploads with dangerous types...

CVE-2024-33529

ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to execute operating system commands via file uploads with dangerous types...

Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading files

Impact This CVE covers the ability of 3rd party websites to access routes and upload files to users running Gradio applications locally. For example, the malicious owners of www.dontvisitme.com could put a script on their website that uploads a large file to http://localhost:7860/upload and anyon...

PT-2024-25298 · Ilias · Ilias

Name of the Vulnerable Software and Affected Versions: ILIAS versions 7.0.0 through 7.29 ILIAS versions 8.0.0 through 8.10 Description: A Stored Cross-site Scripting XSS issue allows remote authenticated attackers with tutor privileges to inject arbitrary web script or HTML via XML file upload...

PT-2024-25299 · Ilias · Ilias

Name of the Vulnerable Software and Affected Versions: ILIAS versions 7.0 through 7.29 ILIAS versions 8.0 through 8.10 ILIAS version 9.0 Description: The issue allows remote authenticated attackers with administrative privileges to execute operating system commands via file uploads with dangerous...

ILIAS 安全漏洞

ILIAS is an open source learning management system. A security vulnerability exists in ILIAS versions 7.20 through 7.30, 8.4 through 8.10, and 9.0, which stems from a stored cross-site scripting XSS vulnerability that allows remote, authenticated attackers to inject arbitrary web script or HTML...

ILIAS 安全漏洞

ILIAS is an open source learning management system. A security vulnerability exists in ILIAS versions 7.x prior to 7.30 and 8.x prior to 8.11, which stems from a stored cross-site scripting XSS vulnerability that could allow a remote, authenticated attacker to inject arbitrary web script or HTML...

SourceCodester Vehicle Management 代码问题漏洞

SourceCodester Vehicle Management is a vehicle management software from SourceCodester, Inc. A code issue exists in the SourceCodester Vehicle Management System up to version 1.0, which is caused by an unknown function in the component HTTP POST Request Handler. that causes unrestricted uploads v...

Multiple vulnerabilities in Field Logic DataCube

Overview DataCube provided by Field Logic Inc. contains multiple vulnerabilities listed below. Direct Request 'Forced Browsing' CWE-425 - CVE-2024-25830 Reflected cross-site scripting CWE-79 - CVE-2024-25831 Unrestricted upload of file with dangerous type CWE-434 - CVE-2024-25832 SQL injection...