CVE-2024-55515

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /uploadipslib.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded...

CVE-2024-55514

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /uploadsfmig.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded, potentially leading to unauthorized access to server permissions...

Critical Apache Struts File Upload Vulnerability (CVE-2024-53677)—Risks, Implications, and Enterprise Countermeasures

Apache has announced a critical vulnerability affecting Apache Struts CVE-2024-53677, a widely used Java-based web application framework. Struts is integral to many enterprise environments due to its robust architecture, extensive data validation capabilities, and seamless integration with other...

CVE-2024-55514

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /uploadsfmig.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded, potentially leading to unauthorized access to server permissions...

CVE-2024-55513

CVE-2024-55513 affects Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 (version 3.90). The web interface endpoint /upload_netaction.php allows crafting a form name to upload arbitrary files, potentially leading to unauthorized server access. Reports from multiple sources confirm the same issue; PT-2024...

CVE-2024-55515

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /uploadipslib.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded...

CVE-2024-54285 WordPress SeedProd Pro plugin <= 6.18.10 - Remote Code Execution (RCE) vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in SeedProd LLC SeedProd Pro allows Upload a Web Shell to a Web Server.This issue affects SeedProd Pro: from n/a through 6.18.10...

CVE-2024-54285 WordPress SeedProd Pro plugin <= 6.18.10 - Remote Code Execution (RCE) vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in SeedProd LLC SeedProd Pro allows Upload a Web Shell to a Web Server.This issue affects SeedProd Pro: from n/a through 6.18.10...

CVE-2024-54370

Unrestricted Upload of File with Dangerous Type vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Upload a Web Shell to a Web Server.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through = 1.1.0...

CVE-2024-54370

CVE-2024-54370 affects Video & Photo Gallery for Ultimate Member. The issue is an Unrestricted Upload of File with Dangerous Type, allowing an attacker to upload a Web Shell to the target server. Affected versions are Video & Photo Gallery for Ultimate Member: from n/a through 1.1.0. Red Hat and ...

Remote Code Execution (RCE)

org.apache.struts, struts2-core is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper validation and handling of file uploads, allowing attackers to potentially upload and execute malicious files on the server...

Apache Struts 2.0.0 <=> 2.3.37(EOL) / 2.5.0 <=> 2.5.33 / 6.0.0 <=> 6.3.0.2 Remote Code Execution (S2-067)

The version of Apache Struts installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the S2-067 advisory. - File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts

🚨🚨 CVE-2024-53677-S2-067🚨🚨 Security Advisory: CVE-2024-53677 –...

CVE-2024-54262

Unrestricted Upload of File with Dangerous Type vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Import Export For WooCommerce: from n/a through = 1.6.2...

CVE-2024-54262

CVE-2024-54262 concerns the WordPress plugin Import Export For WooCommerce (versions up to 1.5). The vulnerability is described as Unrestricted Upload of File with Dangerous Type, enabling an attacker to upload a web shell to the web server. Public sources (Red Hat advisory) corroborate the same ...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-50623link is external Cleo Multiple Products Unrestricted File Upload Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cybe...

CVE-2024-9290 Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload

The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibkrestoremigratecheck function in all versions up to, and including, 2.3.3. This makes it possible for...

CVE-2024-12042

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload functionality in all versions up to, and including, 4.16.4 due to insufficient file type validation. This makes it possible for...

CVE-2024-12042 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting)

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload functionality in all versions up to, and including, 4.16.4 due to insufficient file type validation. This makes it possible for...

CVE-2024-12300

The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the setarfeaturedimage function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging ...