9431 matches found
Moodle Input Validation Error Vulnerability
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. An input validation error vulnerability exists in Moodle that stems from the program failing to properly check the size of private file...
Directory traversal
The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks .php uploads...
CVE-2016-10759
The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks .php uploads...
CVE-2016-10759
CVE-2016-10759 describes a path traversal vulnerability in Precurio 2.1 via the Xinha plugin. The flaw is in ExtendedFileManager/Classes/ExtendedFileManager.php, where ExtendedFileManager can be used to rename the .htaccess file that blocks PHP uploads, enabling directory traversal and resulting ...
CVE-2017-11740
In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrence of an alarm. An attacker can abuse this functionality by uploading a malicious script that can be executed on the remote system...
CVE-2019-12185
eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the we...
CVE-2019-12185
CVE-2019-12185 affects eLabFTW 1.8.5. The /app/controllers/EntityController.php component is vulnerable to arbitrary file uploads, enabling remote code execution by writing PHP files to the web root; an authenticated user can trigger this via a POST request. Public exploit/example details exist (...
PT-2019-12686 · Elabftw · Elabftw
Name of the Vulnerable Software and Affected Versions: eLabFTW version 1.8.5 Description: The issue allows for arbitrary file uploads via the /app/controllers/EntityController.php component, potentially resulting in remote command execution. An attacker can use a user account to fully compromise...
Design/Logic Flaw
ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/core/backups/upload.php aka backup component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PH...
PT-2019-12544
Name of the Vulnerable Software and Affected Versions SimplyBook.me versions prior to 2019-05-11 Description The issue is related to improper restriction of file uploads, which could potentially allow remote code execution. Recommendations For versions prior to 2019-05-11, update to a version...
Exploit for Path Traversal in Ninjaforms Ninja_Forms_File_Uploads
CVE-2019-10869 Wordpress Ninja Forms File Uploads Extension...
Path traversal
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress when the Uploads add-on is activated. This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php aka upload/submit page name and...
GitLab: Importing GitLab project archives can replace uploads of other users
Summary Importing a modified exported GitLab project archive can overwrite uploads for other users. If the secret and file name of an upload are known these can be easily identified for any uploads to public repositories, any user can import a new project which overwrites the served content of th...
IBM BigFix Platform Unauthorized Operation Vulnerability
IBM BigFix Platform is a dynamic, content-driven messaging and management system from IBM, USA. A security vulnerability exists in IBM BigFix Platform versions 9.5 through 9.5.11. An attacker could exploit the vulnerability to upload files to the server with elevated privileges and perform...
Ninja Forms File Uploads Extension <= 3.0.22 - Unauthenticated Arbitrary File Upload
The ninja-forms-uploads WordPress plugin was affected by an Unauthenticated Arbitrary File Upload security vulnerability...
WordPress Ninja Forms File Uploads Extension premium plugin <= 3.0.22 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by Jasper Weijts Onvio in WordPress Ninja Forms File Uploads Extension premium plugin versions = 3.0.22. Solution Update the WordPress Ninja Forms File Uploads Extension premium plugin to the latest available version at least 3.0.23...
Design/Logic Flaw
IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges. This results in code execution on underlying system with root privileges. IBM X-Force ID: 155887...
CVE-2018-19586
Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call. This vulnerability enables regular users to write arbitrary files on the...
CVE-2018-19586
Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call. This vulnerability enables regular users to write arbitrary files on the...
Directory traversal
Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call. This vulnerability enables regular users to write arbitrary files on the...