PHPOK 代码问题漏洞

PHPOK is an enterprise building system that supports expansion. PHPOK 5.7.140 version of the code problem vulnerability, the vulnerability stems from the existence of a file upload vulnerability, a remote attacker can use this vulnerability through the upload of the produced zip file to run...

Octopus Deploy 资源管理错误漏洞

Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. Octopus Deploy suffers from a security vulnerability that stems from the possibility of uploading zipbomb files as a task that leads to a denial of service...

AgilePoint NX 代码问题漏洞

AgilePoint NX is a cloud-based digital transformation platform from AgilePoint Japan that enables enterprise-grade BPMS with no-code and low-code speed and agility. A security vulnerability exists in AgilePoint NX v8.0 SU2.2 & SU2.3. An attacker exploits the vulnerability to perform an insecure...

PYSEC-2023-61

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField only the last uploaded file was validated. However,...

Jedox 2020.2.5 Configurable Storage Path Remote Code Execution

Exploit Title: Jedox 2020.2.5 - Remote Code Execution via Configurable Storage Path Date: 28/04/2023 Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL Vendor Homepage: https://jedox.com Version: Jedox 2020.2 20.2.5 and older CVE : CVE-2022-47878...

Weaver E-Office 代码问题漏洞

Weaver E-Office is a collaborative office system from China's Panmicro Technology Weaver. A code issue vulnerability exists in Weaver E-Office version 9.5, which stems from the presence of an unknown function in App/Ajax/ajax.php?action=mobileuploadsave, which leads to unrestricted uploads via th...

python-django: Potential denial-of-service vulnerability in file uploads

A memory exhaustion flaw was found in the python-django package. This issue occurs when passing certain inputs, leading to a system crash and denial of service...

python-django: Potential denial-of-service vulnerability in file uploads

A memory exhaustion flaw was found in the python-django package. This issue occurs when passing certain inputs, leading to a system crash and denial of service...

UBUNTU-CVE-2023-31047

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField only the last uploaded file was validated. However,...

SUSE-SU-2023:2080-1 Security update for python-Django1

This update for python-Django1 fixes the following issues: - CVE-2023-24580: Fixed potential DoS in file uploads bsc1208082...

The vulnerability of the Upload function in the tpAdmin library allows a perpetrator to execute arbitrary code.

The vulnerability of the Upload function application\admin\controller\Upload.php in the tpAdmin library relates to the unlimited uploading of dangerous types of files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

PT-2023-15510

Name of the Vulnerable Software and Affected Versions Jedox version 2020.2.5 Description The issue is related to incorrect input validation for the default-storage-path in the settings page, allowing remote, authenticated users to specify the location as the Webroot directory. This can lead to th...

CVE-2022-45802 Apache StreamPark (incubating): Upload any file to any directory

Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high-risk files, and may upload them to any directory, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later...

PT-2023-14756 · Apache · Apache Streampark

Name of the Vulnerable Software and Affected Versions: Apache StreamPark versions prior to 2.0.0 Description: The issue allows any user to upload a jar as an application without mandatory verification of the uploaded file type. This enables users to upload high-risk files and potentially upload...

PT-2023-19466 · Unknown · Zhong Bang Crmeb

Name of the Vulnerable Software and Affected Versions: Zhong Bang CRMEB version 4.6.0 Description: A critical issue affects the videoUpload function in the file SystemAttachmentServices.php, allowing unrestricted upload through manipulation of the filename argument. This can be initiated remotely...

Zhongbang CRMEB 代码问题漏洞

Zhongbang CRMEB is an open source e-commerce management system from Zhongbang Networks Zhongbang in Xi'an, China. A code issue vulnerability exists in Zhongbang CRMEB version 4.6.0, which stems from an incorrect operation of the parameter filename resulting in unrestricted file uploads...

Desdev DedeCMS 代码问题漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has features such as content publishing, content management, content editing and content retrieval. A code issue vulnerability exist...

PT-2023-19494 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.106 Description: A critical issue was found, affecting the UpDateMemberModCache function of the file uploads/dede/config.php. This issue leads to unrestricted upload and can be exploited remotely. Recommendations: For...

PT-2023-23272 · Unknown · Startsharp +1

Name of the Vulnerable Software and Affected Versions: Serenity Serene versions prior to 6.7.0 StartSharp versions prior to 6.7.0 Description: A security issue was discovered where users can upload temporary files with certain file endings, such as .html or .htm, that contain a malicious payload...

Serenity Serene 跨站脚本漏洞

Serenity Serene is serenity open source is an ASP.NET Core / TypeScript application platform . A security vulnerability exists in Serenity Serene StartSharp versions prior to 6.7.0, which stems from the fact that when a user uploads a temporary file, certain specific file extensions are not...