CVE-2020-15073: Improper Neutralization of Input During Web Page Generation

An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section...

CVE-2020-12882: Improper Neutralization of Input During Web Page Generation

Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow...

CVE-2020-10669

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able to connect to the device's web interface can get a copy of the documents uploaded by any users. NOTE: this is fixed in the late...

CVE-2018-19599

Monstra CMS 1.6 is affected by an XSS vulnerability triggered by uploading an SVG file to the admin/filesmanager uploads path (admin/index.php?id=filesmanager&path=uploads/). Root cause is improper handling/sanitization of SVG content, enabling stored or reflected XSS within the admin UI. The ava...

Design/Logic Flaw

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 rb65251d6-b368 has XSS via an uploaded document, when the attacker has write access to a project...

CVE-2020-8778

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 rb65251d6-b368 has XSS via an uploaded document, when the attacker has write access to a project...

Code injection

An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user...

CVE-2018-19918

CuppaCMS has XSS via an SVG document uploaded to the administrator//component/tablemanager/view/cuviews URI...

Security Bulletin: Missing authorization concept for document upload and download in IBM Business Process Manager (BPM) CMIS integration (CVE-2015-1904)

Summary IBM Business Process Manager offers integration with external Enterprise Content Management ECM systems. If a process app is configured to always connect to an external ECM system using a predefined technical system account rather than the actual end user, then the process app developer h...

MS16-088: Description of the security update for SharePoint Server 2016: July 12, 2016

None None...

CVE-2016-0322: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 through CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML by uploading an HTML document...

Zenario CMS 7.0.7c Remote Code Execution Vulnerability

Zenario CMS versions 7.0.7c and 7.1.0 and below suffer from a remote code execution vulnerability. Zenario CMS 7.0.7c Remote Code Execution Vulnerability Vendor: Tribal Ltd. Product web page: http://www.zenar.io Affected version: = 7.0.7c and 7.1.0 svn Summary: Zenario is a web-based content...

Shoot off piikee auction website system injection vulnerability and fix-vulnerability warning-the black bar safety net

Because there are no manufacturers, just write a bidding system to it, came out good to With this system webmasters mind you. The system is called: shoot off piikee auction website system Why say 2B? The reception is all the files the parameter values are such, we see this code newsarc.php ? php...

Design/Logic Flaw

The Scanner File Utility aka listener in Kyocera Mita KM 3.3.0.1 uses a small space of predictable user identification numbers for access control, which allows remote attackers to upload documents via a brute force attack...

CVE-2008-7113: Undefined Security Weakness

The Scanner File Utility aka listener in Kyocera Mita KM 3.3.0.1 uses a small space of predictable user identification numbers for access control, which allows remote attackers to upload documents via a brute force attack...

White Wolf Labs #080826-1: Kyocera Mita Scanner File Utility (Multiple)

White Wolf Labs 080826-1: Kyocera Mita Scanner File Utility Multiple Product: Kyocera Mita Scanner File Utility 3.3.0.1 Platform: NA Requirements: NA Credits: Seth Fogie White Wolf Security http://www.whitewolfsecurity.com August 26, 2008 Risk Level: High - Unauthorized document upload / File...

CVE-2004-0534

Cross-site scripting XSS vulnerability in Business Objects InfoView 5.1.4 through 5.1.8 for WebIntelligence 2.7.0 through 2.7.4 allows remote attackers to inject arbitrary web script or HTML via document names when uploading a document...

CVE-2004-0614

osTicket implements a trust-based upload size check using a hidden form field in the submit form, which could allow a remote attacker to upload a file of any size. Reported across CVE-2004-0614 with an impact of partial integrity and partial availability, potentially enabling a denial-of-service ...

Sun ONE Unified Development Server 5.0 - Recursive Document Type Definition

Sun ONE Unified Development Server 5.0 - Recursive Document Type Definition source: https://www.securityfocus.com/bid/6626/info It has been reported that problems with the handling of recursive document type definitions DTDs occur in Sun ONE Unified Development Server UDS. When a document is...