CVE-2021-27902: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads...

Pixel＆tonic Craft CMS 跨站脚本漏洞

Craft CMS is a content management system for developers, designers and web professionals that provides flexibility, power and ease of use. A cross-site scripting vulnerability exists in a front-end form that accepts user uploads in versions of Craft CMS prior to 3.6.0. Detailed vulnerability...

PT-2021-17656

Name of the Vulnerable Software and Affected Versions: Craft CMS versions prior to 3.6.0 Description: An issue was discovered in connection with front-end forms that accepted user uploads, potentially leading to a XSS vulnerability in certain circumstances. Recommendations: For versions prior to...

CVE-2021-29100

A path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted input. An attacker could exploit this vulnerability to gain arbitrary code execution under security context of the user running ArcGIS...

CVE-2019-10134

A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded...

GitLab: Importing GitLab project archives can replace uploads of other users

Summary Importing a modified exported GitLab project archive can overwrite uploads for other users. If the secret and file name of an upload are known these can be easily identified for any uploads to public repositories, any user can import a new project which overwrites the served content of th...

CVE-2018-9999

In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the default LOCALUPLOADSDIR storage backend...

CVE-2018-9999

In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the default LOCALUPLOADSDIR storage backend...

Cross site scripting

In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the default LOCALUPLOADSDIR storage backend...

CVE-2018-9999

CVE-2018-9999 affects Zulip Server prior to 1.7.2. The issue is an XSS vulnerability triggered by user uploads when using the default LOCAL_UPLOADS_DIR storage backend. The connected sources confirm this is a cross-site scripting flaw in versions

CVE-2018-9999

In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the default LOCALUPLOADSDIR storage backend...

CVE-2018-9999: Improper Neutralization of Input During Web Page Generation

In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the default LOCALUPLOADSDIR storage backend...

IRCCloud: Missing robots exclusion header for user uploads

User uploaded text files can be linked from external websites and end up appearing in search engine result pages if you perform a search such as: site:.irccloud-cdn.com ext:txt It's not possible to completely prevent such listings on all search engines, but some search crawlers support the...

Serverless, Real-time Malware Detection: BinaryAlert

BinaryAlert is an open-source serverless AWS pipeline where any file uploaded to an S3 bucket is immediately scanned with a configurable set of YARA rules. An alert will fire as soon as any match is found, giving an incident response team the ability to quickly contain the threat before it spread...

Debian Security Advisory DSA 2957-1 (mediawiki - security update)

Omer Iqbal discovered that Mediawiki, a wiki engine, parses invalid usernames on Special:PasswordReset as wikitext when $wgRawHtml is enabled. On such wikis this allows an unauthenticated attacker to insert malicious JavaScript, a cross site scripting attack. OpenVAS Vulnerability Test $Id:...

Joomla! Component com_jesectionfinder - Arbitrary File Upload

-------------------------------------------------------------------------------------- Sid3^effects aKa HaRi Greetz to all Andhra Hackers and ICW MemebersIndian Cyber Warriors Thanks:L0rd ÇrusAdêr,d4rk-blu™®,R45C4L idi0th4ck3r,CR4C| 008,M4n0j,MaYuR ShouTZ:kedar,dec0d3r Catch us at...

CVE-2008-6771: Undefined Security Weakness

YourPlace 1.0.2 and earlier allows remote attackers to obtain sensitive system information via a direct request via a direct request to user/uploads/phpinfo.php, which calls the phpinfo function...