CVE-2022-38638

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource...

CVE-2022-38638: Improper Limitation of a Pathname to a Restricted Directory

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource...

PT-2022-38370

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource...

CVE-2022-29632: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file...

PT-2022-19739

Name of the Vulnerable Software and Affected Versions Roncoo Education version 9.0.0 Description The issue is related to an arbitrary file upload vulnerability in the /course/api/upload/pic component, allowing attackers to execute arbitrary code via a crafted file. Recommendations For Roncoo...

Roncoo Education code-related vulnerabilities

Roncoo Education is an online education platform from China-based Roncoo. A security vulnerability exists in Roncoo Education version v9.0.0, which stems from an arbitrary file upload issue in the /course/api/upload/pic component. An attacker can exploit the vulnerability to execute arbitrary cod...

DRUPAL-CORE-2021-008

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the...

CVE-2019-1889 Cisco Application Policy Infrastructure Controller REST API Privilege Escalation Vulnerability

A vulnerability in the REST API for software device management in Cisco Application Policy Infrastructure Controller APIC Software could allow an authenticated, remote attacker to escalate privileges to root on an affected device. The vulnerability is due to incomplete validation and error checki...

CVE-2019-10719

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714...

PT-2019-12009

Name of the Vulnerable Software and Affected Versions BlogEngine.NET versions 3.3.7.0 and earlier Description The issue allows Directory Traversal and Remote Code Execution due to mishandled file creation. This is related to the /api/upload endpoint and the...