CVE-2020-11960

Xiaomi router R3600 ROM before 1.0.50 is affected by a vulnerability when checking backup file in cupload interface let attacker able to extract malicious file under any location in /tmp, lead to possible RCE and DoS...

Cross site scripting

A cross-site scripting XSS vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient validation in the file upload interface. A...

CVE-2019-19370: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient validation in the file upload interface. A...

CVE-2019-17376

cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface SEC-521...

CVE-2019-17376

CVE-2019-17376 affects cPanel prior to 82.0.15, where the SSL Certificate Upload interface is vulnerable to self-XSS due to insufficient validation in client-side data handling. Multiple sources confirm the flaw exists in the SSL Certificate Upload feature and is tied to versions older than 82.0....

cPanel cross-site scripting vulnerability (CNVD-2019-27021)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in the alias upload interface in versions prior to cPanel 60.0.25. The vulnerability...

CVE-2016-10784

cPanel before 60.0.25 allows self XSS in the alias upload interface SEC-184...

CVE-2018-20926

cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface SEC-380...

CVE-2018-20925

cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface SEC-379...

Design/Logic Flaw

cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface SEC-379...

CVE-2018-18830

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

WordPress: Buddypress 2.9.1 - Exceeding the maximum upload size - XSS leading to potential RCE.

Description This report is very similar to https://hackerone.com/bugs?subject=user&reportid=203515 so I will not go into too much details. When uploading a avatar or profile background image thats larger than allowd, the error containing the filename will be output unsanitized leading to XSS...

Cisco 8800 Series IP Phone Directory Traversal Vulnerability

A vulnerability in the license upload interface of Cisco 8800 Series IP Phones could allow an authenticated, remote attacker to delete arbitrary files from the filesystem. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by uploading invalid...

CVE-2013-5541

Cross-site scripting XSS vulnerability in the file-upload interface in Cisco Identity Services Engine ISE allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename, aka Bug ID CSCui67495...

CVE-2013-5541: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the file-upload interface in Cisco Identity Services Engine ISE allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename, aka Bug ID CSCui67495...