9430 matches found
CVE-2018-20924
cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads SEC-378...
CVE-2018-20924
cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads SEC-378...
Design/Logic Flaw
cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads SEC-378...
CVE-2018-20924
cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads SEC-378...
PT-2019-10357
Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 70.0.23 Description: The issue allows for arbitrary file-read and file-unlink operations through WHM style uploads. Recommendations: For versions prior to 70.0.23, update to version 70.0.23 or later to resolve the iss...
CVE-2018-20924: Improper Authentication
cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads SEC-378...
The vulnerability of the automated personal data management system “Tula” lies in its ability to load files of a harmful type without limitation, allowing an attacker to execute arbitrary code.
The vulnerability of the automated personal data management system “Tula” is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading a specially crafted file onto the server using a specially crafted POST...
PT-2019-13687 · Veritas · Veritas Resiliency Platform
Name of the Vulnerable Software and Affected Versions: Veritas Resiliency Platform versions prior to 3.4 HF1 Description: An issue allows a user with sufficient privileges to overwrite any file in the virtual machine through a directory traversal vulnerability when uploading an application bundle...
LayerBB Code Issues Vulnerabilities
LayerBB is a small set of forum software. A code issue vulnerability exists in LayerBB version 1.1.3, which stems from the program not restricting the customlogo file name suffix. An attacker can exploit this vulnerability to upload arbitrary files...
RANGER Studio Directus Code Execution Vulnerability (CNVD-2019-39679)
RANGER Studio Directus is a set of open source headless CMS and API for managing custom databases from RANGER Studio, U.S.A. The Directus API is one of the components that can add a RESTful API layer to new or existing SQL databases. A security vulnerability exists in the RANGER Studio Directus 7...
CVE-2019-13979
In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads//originals remote code execution...
CVE-2019-13980
Directus 7 API (up to version 2.3.0) permits PHP uploads only when using Apache; with nginx, uploads/_/originals can lead to remote code execution. No exploitation details are provided in the given documents beyond this risk description. Remediation/patch details are not included in the connected...
PT-2019-13510
Name of the Vulnerable Software and Affected Versions Directus versions 7 through 2.3.0 Description The issue allows remote attackers to read image files by making a direct request for a filename under the uploads/ /originals/ directory. This is related to a configuration option where the file...
PT-2019-13509
Name of the Vulnerable Software and Affected Versions Directus versions 7 through 2.3.0 Description The issue allows for remote code execution through uploads of PHP files when using nginx, as the upload blocking only works with Apache HTTP Server. Recommendations For Directus versions 7 through...
CVE-2019-13979: Unrestricted Upload of File with Dangerous Type
In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads//originals remote code execution...
CVE-2019-13981: Direct Request
In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads//originals/ directory. This is related to a configuration option in which the file collection can be non-public, but this option does not apply to the thumbnailer...
Malicious Package
midway-dataproxy is a malicious package. The package uploads system information to a remote server, downloads a file and executes it...
Malicious Package
hsf-clients is a malicious package. The package uploads system information to a remote server, downloads a file and executes it...