CVE-2024-1069 Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload

The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'viewpage' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to uploa...

openBI Code Issues Vulnerabilities

openBI is a big data visualization solution from openBI. A code issue vulnerability exists in openBI prior to version 1.0.8, which stems from a problem in the index function of the /application/plugins/controller/Upload.php file, which could lead to unrestricted file uploads...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 Hotfix 1 (6.0.1-85)

This update provides stability and performance improvements. Vulnerability id: VSTOR-72592 Increased the speed of VM filtering in clusters with a huge number of existing projects. Vulnerability id: VSTOR-79462 Parts of a multipart object are not deleted. Vulnerability id: VSTOR-79650, VSTOR-80493...

openBI 代码问题漏洞

openBI is a big data visualization solution from openBI. A code issue vulnerability exists in openBI prior to version 1.0.8, which stems from a problem with the uploadUnity function of the /application/index/controller/Unity.php file, which could lead to unrestricted file uploads...

PT-2024-16217 · Openbi · Openbi

Name of the Vulnerable Software and Affected Versions: openBI versions up to 1.0.8 Description: A critical issue affects the uploadIcon function of the file /application/index/controller/Screen.php in the Icon Handler component, leading to unrestricted upload. The attack can be initiated remotely...

CVE-2024-23822 Thruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22)

Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as...

CVE-2023-7089

CVE-2023-7089 – Easy SVG Allow (WordPress)

Code injection

When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user. The attack requires a logged-in other user to know the UUID. While the legitimate user completes the comment, the malicious user can add more files to the comment. This issue affec...

PT-2024-2036 · Otrs · Otrs

Name of the Vulnerable Software and Affected Versions: OTRS versions 7.0.X through 7.0.48 OTRS versions 8.0.X through 8.0.37 OTRS versions 2023 through 2023.1.1 Description: The issue is related to an Improper Input Validation vulnerability in the upload functionality for user avatars, which allo...

Exploit for CVE-2023-47400

CVE-2023-47400 Proof of Concept for the CVE-2023-47400 Aut...

WordPress SVG Uploads Support Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)

Software SVG Uploads Support Type Plugin Vulnerable versions = 2.1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7086 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 52aea6469dda Credits Bob Matyas Required...

CVE-2023-47115 Label Studio XSS Vulnerability on Avatar Upload

Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary...

a-blog cms security breach

a-blog cms is a Japanese content management system CMS. A security vulnerability exists in a-blog cms. A remote attacker can exploit this vulnerability to execute arbitrary JavaScript code by uploading a specially crafted SVG file. The following versions are affected: version 3.1.x to version 3.1...

SVG Uploads Support <= 2.1.1 - Author+ Stored XSS via SVG

Description The plugin does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. Upload an SVG with the following code: alert"xss"; Access the uploaded file directly to see the XSS...

Debian dla-3716 : ruby-httparty - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3716 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3716-1 [email protected] https://www.debian.org/lts/security/...

CVE-2023-7082

The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an...

Design/Logic Flaw

DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/moduleupload.php...

Desdev DedeCMS Security Breach

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system features content publishing, content management, content editing and content retrieval. A security vulnerability exists in DedeCMS...

VulnCheck KEV: CVE-2022-4328

The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server...

a-blog cms security breach

a-blog cms is a Japanese content management system CMS. A security vulnerability exists in a-blog cms versions before Ver.3.1.7, before Ver.3.0.29, before Ver.2.11.58, and before Ver.2.10.50, which can be exploited by an attacker to execute arbitrary code by uploading a specially crafted SVG file...