WordPress-5.3.2 up***.php file has a file upload vulnerability

WordPress is a blogging platform developed using the PHP language. Users can set up their own websites on servers that support PHP and MySQL databases. A file upload vulnerability exists in the Wordpress version 5.3.2 up.php file, which can be exploited by attackers to upload malicious files...

CVE-2014-2025

Unrestricted file upload vulnerability in an unspecified third party tool in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it v...

Kentico CMS < 12.0.50 XSS Vulnerability

Kentico CMS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:kentico:kentico...

CVE-2020-7241

The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 20200..10..20..30..9 format, guessing UNIX...

Catfish Blog has a file upload vulnerability

Catfish Blog is a free personal blogging system. A file upload vulnerability exists in Catfish Blog, which can be exploited by an attacker to upload malicious files and gain administrative privileges on the site...

File Upload Vulnerability in Pharmaceutical Sales Management Software of Guangzhou Jiapeng Software Technology Co.

Guangzhou Jiapeng Software Technology Co., Ltd. is a new type of high-tech enterprise for the pharmaceutical industry, focusing on management software research, application development and pharmaceutical information consulting services. Guangzhou Jiapeng Software Technology Co., Ltd. pharmaceutic...

Fedora 30 : wordpress (2019-da7b49a4b1)

WordPress 5.3.2 Maintenance Release Shortly after WordPress 5.3.1 was released, a couple of high severity Trac tickets were opened. The Core team scheduled this quick maintenance release to resolve these issues. Main issues addressed in 5.3.2 : - Date/Time: Ensure that getfeedbuilddate correctly...

Fedora 31 : wordpress (2019-e16ba9e54e)

WordPress 5.3.2 Maintenance Release Shortly after WordPress 5.3.1 was released, a couple of high severity Trac tickets were opened. The Core team scheduled this quick maintenance release to resolve these issues. Main issues addressed in 5.3.2 : - Date/Time: Ensure that getfeedbuilddate correctly...

CVE-2019-12273

OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. NOTE: The product is self-hosted by the customer, even though it has a .outsystemsenterprise.com domain name. NOTE: The vendor claims that the independent researcher created the repo...

Input validation

DISPUTED OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. NOTE: The product is self-hosted by the customer, even though it has a .outsystemsenterprise.com domain name. NOTE: The vendor claims that the independent researcher created...

CVE-2019-12273

OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. NOTE: The product is self-hosted by the customer, even though it has a .outsystemsenterprise.com domain name. NOTE: The vendor claims that the independent researcher created the repo...

PT-2019-12726 · Outsystems · Outsystems Platform

Name of the Vulnerable Software and Affected Versions: OutSystems Platform versions 10 through 11 Description: The issue allows for CSRF attacks on ImageResourceDetail.aspx, potentially leading to content modifications and file uploads. It is noted that the product is self-hosted by the customer...

CVE-2019-8293

The CVE-2019-8293 issue affects upload-image-with-ajax v1.0 and arises from a logic error in the code, allowing arbitrary files to be uploaded to the web root and enabling code execution. The available connected sources confirm the vulnerability’s presence and the impact (remote code execution vi...

Symlink Attack

drupal/drupal is vulnerable to symlink attacks. The application uses a third-party library ArchiveTar that allows symbolic links by default. When Drupal is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads, an attacker is able to upload compressed files containing malicious filenames...

Drupal Warns Web Admins to Update CMS Sites to Patch a Critical Flaw

If you haven't recently updated your Drupal-based blog or business website to the latest available versions, it's the time. Drupal development team yesterday released important security updates for its widely used open-source content management software that addresses a critical and three...

Backdrop CMS Information Disclosure Vulnerability

Backdrop CMS is an open source content management system CMS. A security vulnerability exists in Backdrop CMS versions 1.13.x prior to 1.13.5 and 1.14.x prior to 1.14.2, which stems from the program's failure to adequately check for invalid data in uploaded archive files. An attacker could exploi...

Drupal 7.x and 8.x Multiple Vulnerabilities (SA-CORE-2019-012) - Linux

Drupal is prone to multiple vulnerabilities in the third-party library ArchiveTar. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

DRUPAL-CORE-2019-012

The Drupal project uses the third-party library Archive\Tar, which has released a security improvement that is needed to protect some Drupal configurations. Multiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and processes them. The late...

Unrestricted File Uploads

Contao is vulnerable to unrestricted file uploads. Back end users with access privileges to the form generator are allowed to upload arbitrary files and execute on the server...

drupal -- Drupal Core - Multiple Vulnerabilities

Drupal Security Team reports: A visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt. Drupal 8 core's filesaveupload function does not strip the leading and trailing dot '.' from filenames, like Drupal 7 did. Users with th...