CVEbaza.pl › Słownik CWE › CWE-69

Common Weakness Enumeration

CWE-69

Improper Handling of Windows ::DATA Alternate Data Stream

Kategoria: VariantCVE: 2

Opis

Produkt nie zapobiega prawidłowo dostępowi do alternatywnych strumieni danych (ADS) ani nie wykrywa ich użycia. Stanowi to lukę w bezpieczeństwie, która może być wykorzystana do ukrycia złośliwego kodu lub danych.

Description (EN)

The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

Podatności CVE z CWE-69 (2)

8.8

CVSS

HIGH

CVE-2024-43033

JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.

pub. 2024-08-22

5.4

CVSS

MEDIUM

CVE-2025-3941

Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

pub. 2025-05-22

Informacje

ID: CWE-69

Typ: Variant

Podatności: 2

MITRE CWE ↗

← Słownik CWE