783 matches found
CVE-2022-30852
Known v1.3.1 was discovered to contain an Insecure Direct Object Reference IDOR...
Design/Logic Flaw
Known v1.3.1 was discovered to contain an Insecure Direct Object Reference IDOR...
Known 注入漏洞
Known is a social publishing platform open-sourced by Known in the United States. A security vulnerability exists in Known v1.3.1 and below, which stems from the discovery of a vulnerability that allows an attacker to perform an account takeover via a host header injection attack...
Known 跨站脚本漏洞
Known is a social publishing platform open-sourced by Known in the United States. A security vulnerability exists in Known v1.3.1 and below, which stems from an issue with the isSVG function that allows an attacker to execute arbitrary code via a crafted SVG file...
Known 安全漏洞
Known is a social publishing platform open-sourced by Known in the United States. A security vulnerability exists in Known v1.3.1 and below, which stems from the discovery of the inclusion of an unsafe direct object reference IDOR...
Known 跨站脚本漏洞
Known is an American Known open source social publishing platform. A security vulnerability exists in Known v1.3.1 and below, which stems from the presence of a cross-site scripting XSS vulnerability that allows an authenticated attacker to execute arbitrary web script or HTML via a crafted paylo...
CVE-2022-1542
The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
GHSA-J7J6-7HFX-5522 Duplicate Advisory: Inconsistent Interpretation of HTTP Requests in Waitress
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4ppp-gpcr-7qf6. This link is maintained to preserve external references. Original Description Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would...
GHSA-RM2J-X595-Q9CJ Django Vulnerable to Cache Poisoning
Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request...
GHSA-W4M6-X6C2-J5C9 Express-FileUpload Arbitrary File Overwrite
An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server. This vulnerability is debated by the package author...
CVE-2022-27140
An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file. NOTE: the vendor's position is that the observed behavior can only occur with "intentional misusing of the API": the express-fileupload...
express-fileupload 代码问题漏洞
express-fileupload is a file upload middleware by Richard Girges, an individual developer in the United States. A code issue vulnerability exists in express-fileupload v1.3.1 that allows attackers to execute arbitrary code via a crafted PHP file...
express-fileupload 代码问题漏洞
express-fileupload is a file upload middleware by Richard Girges, an individual developer in the United States. A security vulnerability exists in express-fileupload v1.3.1, which allows an attacker to upload multiple files with the same name, resulting in the overwriting of files in the web...
PT-2022-18246 · Unknown · Express-Fileupload
Name of the Vulnerable Software and Affected Versions: express-fileupload version 1.3.1 Description: An arbitrary file upload vulnerability in the file upload module of express-fileupload allows attackers to execute arbitrary code via a crafted PHP file. The vendor's position is that the observed...
PT-2022-18338 · Unknown · Express-Fileupload
Name of the Vulnerable Software and Affected Versions: Express-FileUpload version 1.3.1 Description: The issue allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server. This can be exploited due to an arbitrary file write...
CVE-2020-27780 affecting package pam 1.3.1-4
CVE-2020-27780 affecting package pam 1.3.1-4. An upgraded version of the package is available that resolves this issue...
WordPress RevivePress – Keep your Old Content Evergreen plugin < 1.3.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress RevivePress – Keep your Old Content Evergreen plugin versions 1.3.1. Solution Update the WordPress RevivePress – Keep your Old Content Evergreen plugin to the latest available version at least 1.3.1...
PT-2022-13040 · WordPress · Custom Popup Builder
Name of the Vulnerable Software and Affected Versions: Custom Popup Builder WordPress plugin versions prior to 1.3.1 Description: The issue allows unauthenticated users to send data that is not validated in length, potentially causing a denial of service on the blog. This occurs because the plugi...
Code injection
Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine...