CVE-2023-2059

A vulnerability was found in DedeCMS 5.7.87. It has been rated as problematic. Affected by this issue is some unknown functionality of the file uploads/include/dialog/selecttemplets.php. The manipulation leads to path traversal: '..\filedir'. The attack may be launched remotely. The exploit has...

Path traversal

A vulnerability was found in DedeCMS 5.7.87. It has been rated as problematic. Affected by this issue is some unknown functionality of the file uploads/include/dialog/selecttemplets.php. The manipulation leads to path traversal: '..\filedir'. The attack may be launched remotely. The exploit has...

CVE-2023-2059 DedeCMS select_templets.php path traversal

A vulnerability was found in DedeCMS 5.7.87. It has been rated as problematic. Affected by this issue is some unknown functionality of the file uploads/include/dialog/selecttemplets.php. The manipulation leads to path traversal: '..\filedir'. The attack may be launched remotely. The exploit has...

CVE-2023-2059

CVE-2023-2059 affects DedeCMS 5.7.87. A directory-traversal vulnerability exists in the file uploads/include/dialog/select_templets.php, exploitable via the $activepath parameter to read sensitive files. The Nuclei template confirms remote exploitation potential and provides an remediation path: ...

PT-2023-17471 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.87 Description: A problematic issue affects some unknown functionality of the file uploads/include/dialog/select templets.php. The manipulation leads to path traversal, specifically using '..filedir'. This issue can be...

PT-2023-17430 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: froxlor versions prior to 2.0.14 Description: The issue concerns the unrestricted upload of files with dangerous types in the GitHub repository froxlor/froxlor. Specifically, image files uploaded were not properly validated, which could resul...

PT-2023-22336 · Unknown · Employee Performance Evaluation System

Name of the Vulnerable Software and Affected Versions: Employee Performance Evaluation System version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted file uploaded to the server. This is due to an arbitrary file upload vulnerability in the system...

CVE-2023-29850

SENAYAN Library Management System SLiMS Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain information such as the user's geolocation and device information...

Froxlor 代码问题漏洞

Froxlor is a lightweight server management software from the Froxlor team. A code issue vulnerability exists in Froxlor versions prior to 2.0.14, which stems from the presence of unrestricted uploads of dangerous types of files...

Huawei EulerOS: Security Advisory for mod_security (EulerOS-SA-2023-1601)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : mod_security (EulerOS-SA-2023-1601)

According to the versions of the modsecurity package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application...

CVE-2023-27602

In Apache Linkis =1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users upgrade the version of Linkis to version 1.3.2. For versions =1.3.1, we suggest turning on the file path check switch in linkis.properties...

CVE-2023-27602 Apache Linkis publicsercice module unrestricted upload of file

In Apache Linkis =1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users upgrade the version of Linkis to version 1.3.2. For versions =1.3.1, we suggest turning on the file path check switch in linkis.properties...

PT-2023-21243 · Apache · Apache Linkis

Name of the Vulnerable Software and Affected Versions: Apache Linkis versions =1.3.1 Description: The PublicService module in Apache Linkis uploads files without restrictions on the path to the uploaded files and file types. Recommendations: For versions =1.3.1, upgrade to version 1.3.2. For...

tpAdmin 代码问题漏洞

tpAdmin is a ThinkPHP5 based administration backend. A code issue vulnerability exists in yuan1994 tpAdmin version 1.3.12, which stems from an incorrect manipulation of the parameter file resulting in unrestricted uploads...

MGASA-2023-0123 Updated libapreq2 packages fix security vulnerability

A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack. CVE-2022-22728...

springframework: DoS via data binding to multipartFile or servlet part

A flaw was found in Spring Framework. Applications that handle file uploads are vulnerable to a denial of service DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object...

PT-2023-2964 · Cisco · Cisco Webex Meetings

Name of the Vulnerable Software and Affected Versions: Cisco Webex Meetings affected versions not specified Description: The issue is related to multiple vulnerabilities in the web interface of Cisco Webex Meetings. These vulnerabilities could allow an authenticated, remote attacker to conduct a...

Ulearn 代码问题漏洞

UTeM Ulearn is a learning management system organized by UTeM Malaysia. Ulearn suffers from a security vulnerability that stems from the program's failure to verify that an uploaded image is indeed an image. An attacker exploiting this vulnerability could remotely execute code on the server via t...

PT-2023-16441 · Ulearn · Ulearn

Name of the Vulnerable Software and Affected Versions: Ulearn version a5a7ca20de859051ea0470542844980a66dfc05d Description: The issue allows an attacker with administrator permissions to obtain remote code execution on the server through the image upload functionality. This occurs because the...