8632 matches found
Atlassian Confluence < 7.13.17 Read Only User Attachment Uploads Service
According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.13.17, 7.14.0 prior to 7.19.9 or 7.20 prior to 8.2.2. It is, therefore, affected by a flaw which permits remote attackers with read only permissions to a page to upload...
Atlassian Confluence 7.20.x < 8.2.2 Read Only User Attachment Uploads
According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.13.17, 7.14.0 prior to 7.19.9 or 7.20 prior to 8.2.2. It is, therefore, affected by a flaw which permits remote attackers with read only permissions to a page to upload...
PT-2023-4160 · Webmin +1 · Webmin +1
Name of the Vulnerable Software and Affected Versions: Webmin version 2.021 Description: A Cross-site Scripting XSS Bypass vulnerability was discovered in the file upload functionality of Webmin. Normally, the application restricts the upload of certain file types such as .svg, .php, etc., and...
Cross-site scripting (XSS) from MIME type auto-detection of uploaded files
TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to upload an arbitrary file to the content folder. Your Kirby sites are not affected if they don't allow file uploads for untrusted users ...
The vulnerability of the MFileUploadController class in the system for managing, diagnosing, and optimizing the operation of network devices. ProSafe Network Management NMS300 allows a hacker to execute arbitrary code.
The vulnerability of the MFileUploadController class in the ProSafe Network Management NMS300 system, which is used for managing, diagnosing, and optimizing the operation of network devices, stems from the lack of restrictions on file uploads. Exploiting this vulnerability could allow a malicious...
GHSA-F54Q-J679-P9HH copyparty vulnerable to reflected cross-site scripting via k304 parameter
Summary The application contains a reflected cross-site scripting via URL-parameter ?k304=... and ?setck=... Details A reflected cross-site scripting XSS vulnerability exists in the web interface of the application that could allow an attacker to execute malicious javascript code by tricking user...
UBUNTU-CVE-2023-32637
GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload files through the product may execute arbitrary code on the server...
PT-2023-15100 · Vocera · Vocera Voice Server +1
Name of the Vulnerable Software and Affected Versions: Vocera Report Server and Voice Server versions 5.x through 5.8 Description: An issue was discovered that allows for Arbitrary File Upload. The BaseController class, which each of the service controllers derives from, permits the upload of...
PT-2023-35500 · Git-Annex · Git-Annex
Name of the Vulnerable Software and Affected Versions: git-annex versions prior to 6.20160419 Description: A bug in git-annex exposed the checksum of annexed files to encrypted special remotes, which should not have access to this information. This issue occurred when resuming uploads to the...
PT-2023-25037 · Papercut · Papercut Ng
Name of the Vulnerable Software and Affected Versions: PaperCut NG versions 22.0.12 and prior Description: An authentication bypass exists that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage. This could exhaust system resources and...
Dahua Smart Parking Management 代码问题漏洞
Dahua Smart Parking Management is a parking solution from Dahua, China. A code issue exists in Dahua Smart Parking Management versions prior to 20230713, which stems from unknown code in the file /emap/devicePointaddImgIco?hasSubsystem=true, which results in unrestricted uploads via the parameter...
Chengdu Flash Flood Disaster Monitoring and Warning System 代码问题漏洞
Chengdu Flash Flood Disaster Monitoring and Warning System is a flash flood disaster monitoring and warning system in Chengdu. A code issue exists in version 2.0 of the Chengdu Flash Flood Disaster Monitoring and Warning System where an incorrect operation of the parameter userFile can lead to...
House Rental and Property Listing 代码问题漏洞
House Rental and Property Listing is a system developed in PHP, JavaScript, Bootstrap, CSS and MySQL database. It makes it easy for users to find the right house or property for rent. A code issue exists in SourceCodester House Rental and Property Listing System version 1.0 where a vulnerability...
Chengdu Flash Flood Disaster Monitoring and Warning System 代码问题漏洞
Chengdu Flash Flood Disaster Monitoring and Warning System is a flash flood disaster monitoring and warning system in Chengdu. A code issue exists in Chengdu Flash Flood Disaster Monitoring and Warning System version 2.0, the vulnerability stems from the parameter file in the file...
EasyAdmin8 代码问题漏洞
EasyAdmin8 is a server administration suite for Blumlaut individual developers. A code issue vulnerability exists in EasyAdmin8 version 2.0.2.2, which stems from the fact that the file /admin/index/index.html/admin/mall.goods/index.html causes unrestricted uploads...
PT-2023-4778 · WordPress · Forminator
Name of the Vulnerable Software and Affected Versions: Forminator plugin for WordPress versions up to, and including, 1.24.6 Description: The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server ...
Bug Finder Foody Friend 代码问题漏洞
Bug Finder Foody Friend is a SAAS-based web application ordering bot from Bug Finder, Inc. A code issue vulnerability exists in Bug Finder Foody Friend version 1.0, which stems from the parameter profilepicture in the file /user/profile that causes unrestricted uploads...
WordPress Protect Uploads with Login – Protect Your Uploads Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)
Software Protect Uploads with Login – Protect Your Uploads Type Plugin Vulnerable versions = 1.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID e35b81720c5e Credits Rafie...
Fides Webserver Vulnerable to SVG Bomb File Uploads
Impact The Fides webserver is vulnerable to a type of Denial of Service DoS attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs similar to a billion laughs attack, causing resource exhaustion in Admin UI browser tabs and creating a persistent denial...