CVE-2024-42180 HCL MyXalytics is affected by a malicious file upload vulnerability

HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and execute malicious files...

CVE-2024-42180

CVE-2024-42180 affects HCL DRYiCE MyXalytics (HCL MyXalytics). The vulnerability is a malicious file upload issue where the application accepts invalid uploads (wrong content types, double extensions, null bytes, and special characters), enabling an attacker to upload and potentially execute mali...

starsea-mall 安全漏洞

starsea-mall is a springboot +thymeleaf based Xiaomi mall management system by StarSea99 individual developer. A security vulnerability exists in starsea-mall version 1.0, which originates from the parameter file file of the UploadController function in the file...

CVE-2024-47519

Backup uploads to ETM subject to man-in-the-middle interception...

CVE-2024-47519

Backup uploads to ETM subject to man-in-the-middle interception...

CVE-2024-47519 Backup uploads to ETM subject to man-in-the-middle interception

Backup uploads to ETM subject to man-in-the-middle interception...

CVE-2024-47519 Backup uploads to ETM subject to man-in-the-middle interception

Backup uploads to ETM subject to man-in-the-middle interception...

CVE-2024-47519

CVE-2024-47519 is tied to Arista Edge Threat Management – Arista NG Firewall: backup uploads to ETM can be intercepted via a man-in-the-middle. The advisory details the affected product family and versions (NGFW/ETM, 17.1.1 and prior) and provides explicit remediation guidance. The root cause is ...

PT-2025-2770

Name of the Vulnerable Software and Affected Versions: ETM affected versions not specified Description: The issue concerns a man-in-the-middle vulnerability in ETM backup uploads. This allows an attacker to intercept backup uploads to ETM. Recommendations: At the moment, there is no information...

PT-2025-2889 · Unknown · Trippo Responsivefilemanager

Name of the Vulnerable Software and Affected Versions: Trippo Responsive Filemanager version 9.14.0 Description: The issue is related to Cross Site Scripting XSS via file upload using the svg and pdf extensions. This occurs when files with these extensions are uploaded, potentially allowing...

CVE-2024-6155

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated Subscriber+ Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshiftdownloadfilelocaly function...

CVE-2024-12848

The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to uploa...

SpringBoot-Blog 代码问题漏洞

SpringBoot-Blog is a Java blog system for wand individual developers. A code issue vulnerability exists in SpringBoot-Blog version 1.0, which stems from the upload function in file src/main/java/com/my/blog/website/controller/admin/AttachtController.java that can lead to unrestricted uploads...

bookstore 代码问题漏洞

bookstore is an e-commerce bookstore system by donglight individual developer. A code issue vulnerability exists in bookstore version 1.0, which originates from the pictureFile parameter of file src/main/java/org/zdd/bookstore/web/controller/admin/AdminBookController.java that can lead to...

WordPress plugin SKT Page Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

SingMR HouseRent 代码问题漏洞

HouseRent is a house rental management system by Mr.W individual developer. It provides an auto-caching JWK-Set HTTP client. A code issue vulnerability exists in SingMR HouseRent version 1.0, which stems from the singleUpload/upload function in the file...

CVE-2024-12854

The Garden Gnome Package plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the functionality that automatically extracts 'ggpkg' files that have been uploaded in all versions up to, and including, 2.3.0. This makes it possible for authenticated...

CVE-2024-12853

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated attackers, with Author-level access and above, to uploa...

CVE-2024-12853

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated attackers, with Author-level access and above, to uploa...

CVE-2024-12328

The MAS Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, ...