Online Pizza Ordering System 代码问题漏洞

Online Pizza Ordering System is an online pizza ordering system by Carlo Montero Personal Developer. A code issue vulnerability exists in SourceCodester Online Pizza Ordering System version 1.0, which stems from a security issue in the function savemenu that results in unrestricted uploads...

PT-2023-20571 · Sitecore · Sitecore Xp/Xm

Name of the Vulnerable Software and Affected Versions: Sitecore XP/XM version 10.3 Description: An issue exists where an authenticated Sitecore user can upload language files without restrictions, leading to direct code execution on the content management server. Recommendations: For Sitecore XP/...

Online Tours & Travels Management System 代码问题漏洞

Online Tours & Travels Management System is an online tours management system by Mayuri K. Individual developer. A code issue exists in SourceCodester Online Tours & Travels Management System version 1.0, which is caused by an unknown function in the file admin/ab.php, which causes unrestricted...

CVE-2023-0351 CVE-2023-0351

The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload files with executable command instructions...

CVE-2023-0351 CVE-2023-0351

The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload files with executable command instructions...

Authorization Bypass

modsecurity-crs:buster is vulnerable to Authorization Bypass. Use of X.Filename instead of XFilename by an attacker may allow bypassing some PHP script uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid...

CVE-2021-46875

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file...

GHSA-FRGR-C5F2-8QHH Denial of service in Jenkins Core

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 is affected by the Apache Commons FileUpload library’s vulnerability CVE-2023-24998. This library is used to process uploaded files via the Stapler web framework usually through StaplerRequestgetFile and...

GHSA-6X8F-X6QW-QWX3 cockpit-hq/cockpit is vulnerable to unrestricted file uploads

Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1...

cockpit-hq/cockpit is vulnerable to unrestricted file uploads

Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1...

SUSE-SU-2023:0704-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2023-24580: Fixed DOS in file uploads bsc1208082...

Cockpit 代码问题漏洞

Cockpit is an interactive server management interface. A code issue vulnerability exists in versions prior to Cockpit 2.4.1 that stems from a lack of extension checking during file uploads. An attacker can exploit this vulnerability to execute malicious code in the server...

WordPress plugin OoohBoi Steroids for Elementor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Akuvox E11 命令注入漏洞

Akuvox E11 is a SIP visual doorbell from Akuvox designed for villas, houses and apartments. The Akuvox E11 suffers from a command injection vulnerability that stems from a web server backend library that allows command injection in the device's phonebook contact feature. This could allow an...

UCMS 代码问题漏洞

UCMS is a content management system written in PHP. A code issue vulnerability exists in UCMS version 1.6, which stems from an unknown security issue in the file sadmin/fileedit.php in the component System File Management Module, which could lead to unrestricted uploads via the parameter id...

Jenkins 安全漏洞

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. A security vulnerability exists in Jenkins version 2.393 and earlier, LTS version 2.375.3 and earlier. An attacker could...

Atlassian Jira < 9.6.0 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 9.6.0. It is, therefore, affected by multiple vulnerabilities: - A issue in the underlying Spring framework which permits a authenticated attacker to perform a STOMP over...

CVE-2023-22890

SmartBear Zephyr Enterprise through 7.15.0 allows unauthenticated users to upload large files, which could exhaust the local drive space, causing a denial of service condition...

Zephyr 代码问题漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by the Zephyr Project. A security vulnerability exists in SmartBear Zephyr Enterprise version 7.15.0 and prior versions, which originates from a denial of service that allows unauthenticated users to upload large files, thereby...

CVE-2021-4330

The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file type upon extracting uploaded Zip files in the installFreeTemplateKit and uploadTemplateKitZipFile functions. This makes it possible for...