9434 matches found
CVE-2021-24212: Unrestricted Upload of File with Dangerous Type
The WooCommerce Help Scout WordPress plugin before 2.9.1 https://woocommerce.com/products/woocommerce-help-scout/ allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp...
PT-2021-15757
Name of the Vulnerable Software and Affected Versions: WooCommerce Help Scout WordPress plugin versions prior to 2.9.1 Description: The issue allows unauthenticated users to upload any files to the site, which by default will end up in wp-content/uploads/hstmp. Recommendations: For versions prior...
The vulnerability of WebReports servers stems from insufficient protection of the website structure, allowing attackers to upload malicious files and execute arbitrary code.
The vulnerability of the WebReports report server is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to download malicious files and execute arbitrary code...
netty: Information disclosure via the local system temporary directory
In Netty there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used, a local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the...
PT-2021-11455
Name of the Vulnerable Software and Affected Versions: Simple College Website version 1.0 Description: The issue allows a user to conduct remote code execution via the "/alumni/admin/ajax.php?action=save settings" API endpoint when uploading a malicious file using the image upload functionality...
Code injection
An issue was discovered in Nokia NetAct 18A. A remote user, authenticated to the NOKIA NetAct Web Page, can visit the Site Configuration Tool web site section and arbitrarily upload potentially dangerous files without restrictions via the /netact/sct dir parameter in conjunction with the...
netty: Information disclosure via the local system temporary directory
In Netty there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used, a local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the...
CVE-2021-21357
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework...
CVE-2021-21355
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default...
Input validation
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework...
Broken Access Control in Form Framework
Problem Due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework. In the default configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types...
GHSA-3VG7-JW9M-PC3F Broken Access Control in Form Framework
Problem Due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework. In the default configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types...
CVE-2021-21357
TYPO3 Form Framework vulnerability (CVE-2021-21357): Improper input validation in Form Designer enables bypass of predefined option restrictions, allowing upload of arbitrary MIME types and persistence of files in writable TYPO3 directories. Requires a valid backend user to exploit. Affects TYPO3...
PT-2021-14440 · Typo3 · Typo3
Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 8.7.40, 9.5.25, 10.4.14, 11.1.1 Description: The issue arises from improper input validation, allowing attackers to bypass restrictions of predefined options and submit arbitrary data in the Form Designer backend modul...
Cross-site Scripting (XSS)
eZ Platform Kernel is vulnerable to Cross-site Scripting XSS. An attacker is able to inject and execute arbitrary Javascript code in a user's browser by uploading malicious .html and .js files...
VulnCheck KEV: CVE-2021-24212
The WooCommerce Help Scout WordPress plugin before 2.9.1 https://woocommerce.com/products/woocommerce-help-scout/ allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp...
PT-2021-3982 · WordPress · Woocommerce Stock Manager
Name of the Vulnerable Software and Affected Versions: WooCommerce Stock Manager versions up to, and including, 2.5.7 Description: The issue is related to the implementation of the import/export functionality in the WooCommerce Stock Manager plugin for WordPress, specifically in the...
PT-2021-15691 · Unknown · Modern Events Calendar Lite
Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite versions prior to 5.16.5 Description: The issue allows for arbitrary file upload due to improper checking of imported files. An administrator can upload PHP files by using the 'text/csv' content-type in the request...
Wordpress PowerPress 代码问题漏洞
Wordpress PowerPress is Wordpress open source an application plugin . Provides a blog plugin functionality. WordPress PowerPress plugin before 8.3.8 A code issue vulnerability exists that allows arbitrary file uploads...