14801 matches found
CVE-2023-6015 MLflow Arbitrary File Upload
MLflow allowed arbitrary files to be PUT onto the server...
PT-2023-32478
Name of the Vulnerable Software and Affected Versions MLflow affected versions not specified Description The issue allows arbitrary files to be uploaded onto the server using the PUT method. There is no information provided about the estimated number of potentially affected devices or real-world...
CVE-2023-6133
The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminatorallowedmimetypes' function in versions up to, and including, 1.27.0. This makes it possible for authenticated attackers with administrator-level capabilities or above to...
WordPress plugin Forminator security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
WordPress Forminator Plugin <= 1.27.0 is vulnerable to Arbitrary File Upload
Software Forminator Type Plugin Vulnerable versions = 1.27.0 Fixed in 1.28.0 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6133 Patch priority Low CVSS severity Low 6.6 Developer WPMU DEV PSID e543496c8db2 Credits István Márton Required privilege Administrator...
VulnCheck KEV: CVE-2023-20073
A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement...
WordPress Welcart e-Commerce Plugin <= 2.9.4 is vulnerable to Arbitrary File Upload
Software Welcart e-Commerce Type Plugin Vulnerable versions = 2.9.4 Fixed in 2.9.5 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE N/A Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 876ec2065bf2 Credits WordFence Required privilege Subscriber Publish...
WordPress Slider Revolution Plugin <= 6.6.15 is vulnerable to Arbitrary File Upload
Software Slider Revolution Type Plugin Vulnerable versions = 6.6.15 Fixed in 6.6.16 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-47784 Patch priority Low CVSS severity Low 8.4 Developer ThemePunch PSID 92c233355a76 Credits Rafie Muhammad Patchstack Required privile...
Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauthoperation.php that doesn't require authentication, an...
Welcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload
Description The plugin does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server Setup As admin: - Go the the...
Welcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload
Description The plugin does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server PoC Setup As admin: - Go the the...
CVE-2023-37790
Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload function...
CVE-2023-37790
Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload function...
CVE-2023-37790
Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload function...
Design/Logic Flaw
Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload function...
Vulnerability fixed in Progress WS_FTP
Progress has fixed a vulnerability in WSFTP. A authenticated malicious party could exploit the vulnerability to upload files to any location on the file system of the system on which WSFTP is installed. This could result in data overwriting, or affect the operation of the operating system and...
PT-2023-26110 · Jaspersoft · Jaspersoft Clarity Ppm
Name of the Vulnerable Software and Affected Versions: Jaspersoft Clarity PPM version 14.3.0.298 Description: The issue is related to an arbitrary file upload vulnerability via the Profile Picture Upload function. This allows for potential malicious file uploads. Recommendations: For Jaspersoft...
CVE-2023-37790
Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload function...
CVE-2023-37790
CVE-2023-37790 affects Jaspersoft Clarity PPM 14.3.0.298. Affected component: Profile Picture Upload; vulnerability is an arbitrary file upload vulnerability. No exploitation details are provided in the initial/connected docs. A remediation note from PT-Security recommends disabling the Profile P...