The ELEX HelpDesk & Customer Ticketing System (WSDesk) plugin saves attachments from emails fetched over IMAP into the public uploads directory under the sender-supplied filename, checked only against a case-sensitive four-entry extension denylist. Anyone who can send email to the support mailbox can upload a file with an executable extension... Weiterlesen: Unauthenticated Arbitrary File Upload in ELEX HelpDesk IMAP Attachmen…
Intelligence View
⚡ tsecurity.de Intelligence
Unauthenticated Arbitrary File Upload in ELEX HelpDesk IMAP Attachment Handling
The ELEX HelpDesk & Customer Ticketing System (WSDesk) plugin saves attachments from emails fetched over IMAP into the public uploads directory under the…
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
Powered by tsecurity.de
tsecurity.de Hub
Zeka Digest - ücretsiz Günlük en önemli güvenlik haberi · herhangi bir zamanda alınabilir
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
Hiçbir okuyucu henüz yorum yok
Bu sayfa yararlı mıydı?
0
Powered by tsecurity.de
tsecurity.de Hub
İlgili Story Cluster & Kaynaklar (vector AI)
10 Kaynaklar
it-sa 2026: Sind KI-Tools eher Fluch oder Segen?
9 diğer kaynaklar
GGBHackers Securityvor 3 Std.11 Digital Forensics Tools: The 2026 Buyer’s Verdict Guide GGBHackers Securityvor 3 Std.11 Cyber Risk Quantification Tools: The 2026 Buyer’s Verdict Guide GGBHackers Securityvor 3 Std.10 Third-Party / Vendor Risk Management (TPRM) Tools: The 2026 Buyer’s Verdict Guide VVulDB Updatesvor 4 Std.CVE-2026-119672 | MongoDB Database Tools up to 100.20.0 mongofiles privileges management (WID-SEC-2026-4328) VVulDB Updatesvor 4 Std.CVE-2026-119673 | MongoDB Database Tools up to 100.20.0 mongofiles symlink (WID-SEC-2026-4328) VVulDB Updatesvor 4 Std.CVE-2026-119674 | MongoDB Database Tools up to 100.20.0 mongorestore improper authorization (WID-SEC-2026-4328)
+3
7 Kaynaklar
CVE-2026-118869 | SHIRASAGI Project up to 1.21.0 os command injection (EUVD-2026-117397)
6 diğer kaynaklar
VVulDB Updatesvor 1 Std.CVE-2025-57200 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 test_mail command injection VVulDB Updatesvor 1 Std.CVE-2025-57199 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 NetFailDetectD command injection VVulDB Updatesvor 1 Std.CVE-2025-57198 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 Machine.cgi command injection VVulDB Updatesvor 4 Std.CVE-2026-123014 | iTerm2 up to 3.7.7beta1 URL argument injection (EUVD-2026-117332) VVulDB Updatesvor 4 Std.CVE-2026-121621 | Red Hat OpenShift GitOps Argo CD Image Updater command injection (EUVD-2026-116381) VVulDB Updatesvor 4 Std.CVE-2026-77690 | ZohoCorp ManageEngine Key Manager Plus up to 7150 Deployment Target Configuration command injection (EUVD-2026-116757)
7 Kaynaklar
CVE-2026-119179 | MongoDB Node.js Driver up to 6.21.x/7.7.x Connection Management information disclosure (WID-SEC-2026-4328)
6 diğer kaynaklar
VVulDB Updatesvor 3 Std.CVE-2026-120678 | MongoDB C Driver up to 1.30.14/2.5.7 memory leak (WID-SEC-2026-4328) VVulDB Updatesvor 3 Std.CVE-2026-120673 | MongoDB Rust Driver up to 3.9.0 Diagnostic Tracing information disclosure (WID-SEC-2026-4328) VVulDB Updatesvor 3 Std.CVE-2026-120684 | MongoDB C Driver up to 1.30.14/2.5.7 GridFS uninitialized pointer (Nessus ID 376173 / WID-SEC-2026-4328) VVulDB Updatesvor 3 Std.CVE-2026-120952 | MongoDB Atlas SQL ODBC Driver up to 3.0.0 out-of-bounds write (WID-SEC-2026-4328) VVulDB Updatesvor 3 Std.CVE-2026-120953 | MongoDB Atlas SQL JDBC Driver up to 4.0.0 Authentication redirect (WID-SEC-2026-4328) VVulDB Updatesvor 3 Std.CVE-2026-120954 | MongoDB C Driver up to 2.5.7 BSON Vector integer overflow (WID-SEC-2026-4328)
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/tr/4287774/guevenlik-aklar-cve/unauthenticated-arbitrary-file-upload-in-elex-helpdesk-imap-attachment-handling/