52 matches found
PT-2023-23964 · Unknown · Parse Javascript Sdk +1
Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 5.4.4 and 6.1.1 Description: The issue involves a phishing attack vulnerability where a malicious user can upload an HTML file to Parse Server via its public API. This uploaded HTML file can then be accessed at...
Arbitrary File Upload
kiwitcms is vulnerable to Arbitrary File Upload. The vulnerability exists because the library does not properly validate files uploaded, allowing an attacker to bypass the file upload restrictions by uploading a malicious .exe file or embedded JavaScript file, tricking people into clicking on the...
PT-2023-20362 · Ibm · Ibm Security Guardium Key Lifecycle Manager
Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Key Lifecycle Manager versions 3.0 through 4.1.1 Description: The issue allows an attacker to upload files that could be used in a denial of service attack due to incorrect authorization. Recommendations: For versions 3....
SUSE CVE-2015-0340
Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass intended file-upload restrictions via unspecified vectors...
PT-2022-25082 · WordPress · Motors
Name of the Vulnerable Software and Affected Versions: Motors WordPress plugin versions prior to 1.4.4 Description: The issue allows an attacker to upload malicious files, such as .php files, to a WordPress instance due to improper validation of uploaded files in an AJAX action. This can lead to...
CVE-2022-1519
LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit...
CVE-2022-0951
File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4...
Dolibarr ERP/CRM 11.0.4 - File Upload Restrictions Bypass Exploit
Exploit Title: Dolibarr ERP/CRM 11.0.4 - File Upload Restrictions Bypass Authenticated RCE Exploit Author: Andrea Gonzalez Vendor Homepage: https://www.dolibarr.org/ Software Link: https://github.com/Dolibarr/dolibarr Version: Prior to 11.0.5 Tested on: Debian 9.12 CVE : CVE-2020-14209...
The vulnerability of the Magento Commerce software platform for developing and managing online stores lies in the lack of restrictions on file uploads, which allows attackers to execute arbitrary code.
The vulnerability of the Magento Commerce software platform for developing and managing online stores is related to the lack of restrictions on file uploads. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
Unrestricted file upload
The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload...
Arbitrary Code Execution
magento/community-edition is vulnerable to arbitrary code execution. The vulnerability exists as an admin with import feature privileges can make modifications to a configuration file that allows unauthorized removal of file upload restrictions, causing arbitrary code execution...
Design/Logic Flaw
Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...
CVE-2019-7861
Magento 2.x prior to updates 2.1.18, 2.2.x prior to 2.2.9, and 2.3.x prior to 2.3.2 are affected by insufficient server-side validation of user input that can bypass file upload restrictions. The root cause is improper input validation during upload, enabling attackers to upload malicious files. ...
CVE-2019-7861
Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...
CVE-2019-11887
SimplyBook.me through 2019-05-11 does not properly restrict File Upload which could allow remote code execution...
The vulnerability of the onUploadLogPic component of the software controller allows for the insertion of arbitrary HTML code by intruders, enabling them to manipulate wireless networks through the D-Link Central WiFi Manager.
The vulnerability of the onUploadLogPic component of the software controller for D-Link Central WiFi Manager’s centralized wireless network management system is related to insufficient restrictions on file uploads. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML co...
CVE-2018-19196
The CVE-2018-19196 entry concerns XiaoCms 20141229. Affected component: admin/uploadfile.php handling file uploads. Root cause: attackers can bypass file-type restrictions by manipulating the type parameter, enabling remote code execution via an attack like admin/index.php?c=uploadfile&a=uploadif...
PT-2017-4238 · Apache +5 · Apache Tomcat +5
Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 7.0.0 through 7.0.81 Apache Tomcat versions 8.0.0.RC1 through 8.0.46 Apache Tomcat versions 8.5.0 through 8.5.22 Apache Tomcat versions 9.0.0.M1 through 9.0.0 Description: The issue is related to the lack of restriction...
Design/Logic Flaw
The filemanager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-upload restrictions by appending a crafted parameter to the file URL...