Cross-site Scripting (XSS)

eZ Platform Kernel is vulnerable to Cross-site Scripting XSS. An attacker is able to inject and execute arbitrary Javascript code in a user's browser by uploading malicious .html and .js files...

VulnCheck KEV: CVE-2021-24212

The WooCommerce Help Scout WordPress plugin before 2.9.1 https://woocommerce.com/products/woocommerce-help-scout/ allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp...

PT-2021-3982 · WordPress · Woocommerce Stock Manager

Name of the Vulnerable Software and Affected Versions: WooCommerce Stock Manager versions up to, and including, 2.5.7 Description: The issue is related to the implementation of the import/export functionality in the WooCommerce Stock Manager plugin for WordPress, specifically in the...

Wordpress PowerPress 代码问题漏洞

Wordpress PowerPress is Wordpress open source an application plugin . Provides a blog plugin functionality. WordPress PowerPress plugin before 8.3.8 A code issue vulnerability exists that allows arbitrary file uploads...

PT-2021-15691 · Unknown · Modern Events Calendar Lite

Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite versions prior to 5.16.5 Description: The issue allows for arbitrary file upload due to improper checking of imported files. An administrator can upload PHP files by using the 'text/csv' content-type in the request...

CVE-2021-28379

web/upload/UploadHandler.php in Vesta Control Panel aka VestaCP through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin...

CVE-2021-28379

web/upload/UploadHandler.php in Vesta Control Panel aka VestaCP through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin...

CVE-2021-28379

web/upload/UploadHandler.php in Vesta Control Panel aka VestaCP through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin...

Vesta Control Panel 代码问题漏洞

Vesta Control Panel VestaCP is an open source web hosting control panel. A code issue vulnerability exists in Vesta Control Panel version 0.9.8-27 and prior versions, which stems from web upload UploadHandler.php allowing uploads from different sources...

Updated netty packages fix a security vulnerability

When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled CVE-2021-21290...

DEBIAN-CVE-2020-13936

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache...

CVE-2021-21362

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who us...

Design/Logic Flaw

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who us...

Vulnerabilities fixed in Joomla

Several vulnerabilities have been fixed in Joomla. The vulnerabilities potentially enable a malicious party to launch attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Manipulation of data Circumvention of security measure The vulnerability with...

CVE-2021-23132

An issue was discovered in Joomla! 3.0.0 through 3.9.24. commedia allowed paths that are not intended for image uploads...

CVE-2021-23132 [20210306] - Core - com_media allowed paths that are not intended for image uploads

An issue was discovered in Joomla! 3.0.0 through 3.9.24. commedia allowed paths that are not intended for image uploads...

CVE-2021-23132

The CVE-2021-23132 issue affects Joomla! core: versions 3.0.0 through 3.9.24 allow image-upload paths in com_media that were not intended, enabling access to unintended directories. Root cause: insecure handling in com_media leading to path exposure and potential exploitation. Documented impact i...

PT-2021-15387 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.24 Description: An issue was discovered in the com media component, which allowed paths that are not intended for image uploads. Recommendations: For Joomla! versions 3.0.0 through 3.9.24, consider restricti...

Exploit for CVE-2021-23132

CVE-2021-23132 commedia allowed paths that are not intended f...

The vulnerability of the installation file FortiClientEMSOnlineInstaller.exe of the Fortinet FortiClient Enterprise Management Server (EMS) allows a perpetrator to execute arbitrary code.

The vulnerability of the installation file FortiClientEMSOnlineInstaller.exe of the Fortinet FortiClient Enterprise Management Server EMS server is related to errors in the path validation mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code using specially...