CVE-2023-1484

A vulnerability was found in xzjie cms up to 1.0.3 and classified as critical. This issue affects some unknown processing of the file /api/upload. The manipulation of the argument uploadFile leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this...

CVE-2023-1484

A vulnerability was found in xzjie cms up to 1.0.3 and classified as critical. This issue affects some unknown processing of the file /api/upload. The manipulation of the argument uploadFile leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this...

CVE-2023-1484: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in xzjie cms up to 1.0.3 and classified as critical. This issue affects some unknown processing of the file /api/upload. The manipulation of the argument uploadFile leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this...

XZJIE CMS code-related vulnerabilities

xzjie cms is xzjie individual developers of the cloud tower guest - cabin content publishing system. A code issue vulnerability exists in xzjie cms 1.0.3 and earlier versions, which stems from a problem with files/api/upload, where manipulation of the parameter uploadFile can lead to unrestricted...

CVE-2023-23314

An arbitrary file upload vulnerability in the /api/upload component of zdir v3.2.0 allows attackers to execute arbitrary code via a crafted .ssh file...

CVE-2023-23314: Improper Limitation of a Pathname to a Restricted Directory

An arbitrary file upload vulnerability in the /api/upload component of zdir v3.2.0 allows attackers to execute arbitrary code via a crafted .ssh file...

PT-2023-6804

Name of the Vulnerable Software and Affected Versions zdir version 3.2.0 Description The issue is related to an arbitrary file upload vulnerability in the /api/upload component. This vulnerability exists due to incorrect restriction of the directory path name with limited access. Exploitation of...

PYSEC-2022-43190

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource...

PYSEC-2022-43190

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource...

PYSEC-0000-CVE-2022-38638

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource...

CVE-2022-38638

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource...

CVE-2022-38638: Improper Limitation of a Pathname to a Restricted Directory

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource...

PT-2022-38370

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource...

CVE-2022-29632: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file...

PT-2022-19739

Name of the Vulnerable Software and Affected Versions Roncoo Education version 9.0.0 Description The issue is related to an arbitrary file upload vulnerability in the /course/api/upload/pic component, allowing attackers to execute arbitrary code via a crafted file. Recommendations For Roncoo...

Roncoo Education code-related vulnerabilities

Roncoo Education is an online education platform from China-based Roncoo. A security vulnerability exists in Roncoo Education version v9.0.0, which stems from an arbitrary file upload issue in the /course/api/upload/pic component. An attacker can exploit the vulnerability to execute arbitrary cod...

DRUPAL-CORE-2021-008

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the...

CVE-2019-1889 Cisco Application Policy Infrastructure Controller REST API Privilege Escalation Vulnerability

A vulnerability in the REST API for software device management in Cisco Application Policy Infrastructure Controller APIC Software could allow an authenticated, remote attacker to escalate privileges to root on an affected device. The vulnerability is due to incomplete validation and error checki...

CVE-2019-10719

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714...

PT-2019-12009

Name of the Vulnerable Software and Affected Versions BlogEngine.NET versions 3.3.7.0 and earlier Description The issue allows Directory Traversal and Remote Code Execution due to mishandled file creation. This is related to the /api/upload endpoint and the...