46 matches found
CVE-2019-15891
An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0. The documentation has misleading information that could lead to a conclusion that the application has a built-in bulletproof content sniffing protection...
CVE-2019-15862
An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension even if the application was configured to accept files only with a defined set of extensions. This affects CKFinder for ASP, CKFinder for ASP.NET,...
CVE-2019-15891
An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0. The documentation has misleading information that could lead to a conclusion that the application has a built-in bulletproof content sniffing protection...
CVE-2019-15862
An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension even if the application was configured to accept files only with a defined set of extensions. This affects CKFinder for ASP, CKFinder for ASP.NET,...
CVE-2019-15862
An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension even if the application was configured to accept files only with a defined set of extensions. This affects CKFinder for ASP, CKFinder for ASP.NET,...
CVE-2019-15891
An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0. The documentation has misleading information that could lead to a conclusion that the application has a built-in bulletproof content sniffing protection...
Input validation
An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension even if the application was configured to accept files only with a defined set of extensions. This affects CKFinder for ASP, CKFinder for ASP.NET,...
Information disclosure
An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0. The documentation has misleading information that could lead to a conclusion that the application has a built-in bulletproof content sniffing protection...
CVE-2019-15891
An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0. The documentation has misleading information that could lead to a conclusion that the application has a built-in bulletproof content sniffing protection...
CVE-2019-15891
CKFinder versions ≤ 2.6.2.1 and ≤ 3.5.0 are affected by a documentation issue that could mislead users into believing there is built‑in bulletproof content sniffing protection. The root cause is misleading documentation rather than a code flaw disclosed in these sources. Publicly available refere...
CVE-2019-15862
An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension even if the application was configured to accept files only with a defined set of extensions. This affects CKFinder for ASP, CKFinder for ASP.NET,...
CVE-2019-15862
The CVE-2019-15862 issue affects CKFinder up to 2.6.2.1 across CKFinder for ASP, ASP.NET, ColdFusion, and PHP. The root cause is improper checks of file names that allow uploads of files without an extension even when a defined set of extensions is configured. Impact is remote unauthenticated upl...
Fedora 27 : ckeditor (2018-e29c7d10da)
4.9.2 https://ckeditor.com/cke4/release/CKEditor-4.9.2 Security Updates - Fixed XSS vulnerability in the Enhanced Image image2 plugin reported by Kyaw Min Thein. - Issue summary: It was possible to execute XSS inside CKEditor using the tag and specially crafted HTML. Please note that the default...
CVE-2018-7486
Blue River Mura CMS before v7.0.7029 supports inline function calls with an m tag and /m end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an m$.dspinclude"../pathname/executable.jpeg"/m approach, where executable.jpeg...
Design/Logic Flaw
Blue River Mura CMS before v7.0.7029 supports inline function calls with an m tag and /m end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an m$.dspinclude"../pathname/executable.jpeg"/m approach, where executable.jpeg...
CVE-2018-7486
Blue River Mura CMS before v7.0.7029 supports inline function calls with an m tag and /m end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an m$.dspinclude"../pathname/executable.jpeg"/m approach, where executable.jpeg...
CVE-2018-7486
Blue River Mura CMS before v7.0.7029 supports inline function calls with an m tag and /m end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an m$.dspinclude"../pathname/executable.jpeg"/m approach, where executable.jpeg...
QiboCMS v7 /ewebeditor/ckfinder/plugins/fileeditor/codemirror/contrib/php/js/net.php 后门
/ewebeditor/ckfinder/plugins/fileeditor/codemirror/contrib/php/js/net.php?php errorreporting7; //设定错误讯息回报的等级 obstart; //打开缓冲区,当缓冲区激活时，所有来自PHP程序的非文件头信息均不会发送，而是保存在内部缓冲区。为了输出缓冲区的内容，可以使用obendflush或flush输出缓冲区的内容。 $mtime = explode' ', microtime; $starttime = $mtime1 + $mtime0; @settimelimit0;...
WordPress CK-And-SyntaxHighLighter Arbitrary File Upload
Title: Wordpress ck-and-syntaxhighlighter Plugin RFU vulnerability + Date: 2014-08-12 + Author: Hekt0r + Tested on: Windows7 & Kali Linux + Vendor Homepage: http://wordpress.org/ + Software Link: http://wordpress.org/plugins/ck-and-syntaxhighlighter/ + Dork :...
CKFinder 1.4.3 arbitrary file upload vulnerability-vulnerability warning-the black bar safety net
CKFinder is abroad a very popular WYSIWYG text editor,which 1. 4. 3 asp. net version the presence of arbitrary file upload vulnerability attackers can exploit the vulnerability to upload arbitrary files. CKFinder Upload File,force the file name, excluding the suffix, midpoint number, etc. other...