CVE-2021-32660

Backstage TechDocs: In @backstage/techdocs-common versions before 0.6.4, an internal actor can upload content containing malicious scripts. The scripts bypass frontend sanitization when content is viewed via the TechDocs API, potentially exposing sensitive data if the API shares origin with the B...

CVE-2021-31855

KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a decrypted encrypted message stored on a remote server e.g., an IMAP server causes KMail to upload the decrypted content of the message to the remote server. With a crafted message...

PT-2019-16878 · Ibm · Ibm Intelligent Operations Center

Name of the Vulnerable Software and Affected Versions: IBM Intelligent Operations Center IOC versions 5.1.0 through 5.2.0 Description: The issue arises from improper file type validation, allowing an attacker to upload malicious content. Recommendations: For versions 5.1.0 through 5.2.0, update t...

CVE-2019-4069: Unrestricted Upload of File with Dangerous Type

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious content. IBM X-Force ID: 157014...

IBM Intelligent Operations Center and IBM Water Operations for Waternamics File Upload Vulnerability

IBM Intelligent Operations Center IOC and IBM Water Operations for Waternamics are both products of IBM Corporation, U.S.A. IBM Intelligent Operations Center is a suite of city operations solutions. IBM Intelligent Operations Center is a suite of city operations solutions with features such as da...

CVE-2018-20166

A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data, and the filename ends in ".php" with mixed...

CVE-2018-1000811

bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution. This attack appear to be exploitable via malicious user have to upload a crafted payload containing PHP code...

CVE-2018-1000811

bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution. This attack appear to be exploitable via malicious user have to upload a crafted payload containing PHP code...

CVE-2018-1000811: Unrestricted Upload of File with Dangerous Type

bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution. This attack appear to be exploitable via malicious user have to upload a crafted payload containing PHP code...

CVE-2017-15014

OpenText Documentum Content Server formerly EMC Documentum Content Server through 7.3 contains the following design gap, which allows authenticated users to download arbitrary content files regardless of the attacker's repository permissions: When an authenticated user uploads content to the...

Kirby CMS 2.1.0 - CSRF Content Upload and PHP Script Execution Vulnerability

Exploit for php platform in category web applications ============================================= - Release date: 14.09.2015 - Discovered by: Dawid Golunski - Severity: High ============================================= I. VULNERABILITY ------------------------- Kirby CMS = 2.1.0 CSRF Content...

Kirby CMS 2.1.0 - Cross-Site Request Forgery / Content Upload / PHP Script Execution

============================================= - Release date: 14.09.2015 - Discovered by: Dawid Golunski - Severity: High ============================================= I. VULNERABILITY ------------------------- Kirby CMS = 2.1.0 CSRF Content Upload and PHP Script Execution II. BACKGROUND...

New Dangerous Flash Origin Policy Flaw

Hackers can exploit a flaw in Adobe’s Flash to compromise nearly every Web site that allows users to upload content, including Google’s Gmail, then launch silent attacks on visitors to those sites, security researchers said today. Adobe did not dispute the researchers’ claims, but said that Web...

Design/Logic Flaw

uploadimg.php in the Automatic Image Upload with Thumbnails imgUpload module 1.3.2 for PunBB only verifies the Content-type field of uploaded files, which allows remote attackers to upload and execute arbitrary content via a file with a 1 JPG, 2 GIF, or 3 PNG MIME type...

CVE-1999-0360

CVE-1999-0360 affects MS Site Server 2.0 on IIS 4, where the web server can accept uploaded content (including ASP), enabling remote command execution. A Nessus plugin notes a specific verifiable vector: the repost.asp script allows uploading arbitrary files to /Users when misconfigured. Root cau...

CVE-1999-0360: Undefined Security Weakness

MS Site Server 2.0 with IIS 4 can allow users to upload content, including ASP, to the target web site, thus allowing them to execute commands remotely...