3658 matches found
Dell EMC VMAX Virtual Appliance Manager Directory Traversal (CVE-2018-1215)
A directory traversal vulnerability exists in Dell EMC VMAX Virtual Appliance vApp. The vulnerability is due to improper handling of user-supplied requests for file uploads. Successful exploitation of this vulnerability could lead to arbitrary code execution...
Centraleyezer File Upload Vulnerability
Centraleyezer is a vulnerability tracking and management platform. The platform is used for vulnerability reporting, prioritization, escalation and tracking of vulnerabilities. A security vulnerability exists in Centraleyezer. An attacker can exploit the vulnerability to upload dangerous types of...
Improper access control
An issue was discovered in PictureManagemvc.aspx in AUO SunVeillance Monitoring System before v1.1.9e. There is an incorrect access control vulnerability that can allow an unauthenticated user to upload files via a modified authority parameter...
Portainer Directory Traversal Vulnerability
Portainer is an open source lightweight management UI that allows you to easily manage docker hosts or clusters. A directory traversal vulnerability exists in Portainer versions prior to 1.22.1. An attacker can exploit this vulnerability to upload files to arbitrary locations...
AUO SunVeillance Monitoring System 1.1.9e - Incorrect Access Control
AUO SunVeillance Monitoring System 1.1.9e - Incorrect Access Control Exploit Title: AUO SunVeillance Monitoring System 1.1.9e - Incorrect Access Control Date: 2019-10-24 Exploit Author: Luca.Chiou Vendor Homepage: https://www.auo.com/zh-TW Version: AUO SunVeillance Monitoring System all versions...
CVE-2019-16700
The slubevents aka SLUB: Event Registration extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this can result in Denial of Service, since the web space can be...
CVE-2019-16700
The slubevents aka SLUB: Event Registration extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this can result in Denial of Service, since the web space can be...
Cross site scripting
Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack...
CVE-2019-15131
In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may allow arbitrary files to be uploaded to Code42 servers and executed. This vulnerability could allow an attacker to create directories and save files on Code42 servers, which could...
CVE-2017-18592
The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wpupload directory for file uploads...
CVE-2017-18592
The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wpupload directory for file uploads...
CVE-2017-18592
The CVE-2017-18592 vulnerability affects the WordPress plugin woocommerce-catalog-enquiry (versions older than 3.1.0). The issue is an incorrect wp_upload directory used for file uploads, enabling an improper file placement path. Related sources describe this as an Arbitrary File Upload risk, wit...
WordPress wp-file-upload plugin code issue vulnerability
WordPress is a set of blogging platform developed by WordPress Foundation using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-file-upload is a file upload plugin used in it. A code issue vulnerability exists in the WordPress wp-file-upload plugin,...
CVE-2019-15104
An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...
CVE-2019-14794
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders...
Design/Logic Flaw
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders...
CVE-2019-14794
CVE-2019-14794 affects the WordPress Meta Box plugin prior to version 4.16.2. The vulnerability arises from mishandling file uploads to custom folders, with a CVSS3 base score of 7.5 (network/vector, low access complexity, no privileges required, integrity impact HIGH). Public exploitation detail...
The vulnerability of the automated personal data management system “Tula” lies in its ability to load files of a harmful type without limitation, allowing an attacker to execute arbitrary code.
The vulnerability of the automated personal data management system “Tula” is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading a specially crafted file onto the server using a specially crafted POST...
RANGER Studio Directus Code Execution Vulnerability (CNVD-2019-39679)
RANGER Studio Directus is a set of open source headless CMS and API for managing custom databases from RANGER Studio, U.S.A. The Directus API is one of the components that can add a RESTful API layer to new or existing SQL databases. A security vulnerability exists in the RANGER Studio Directus 7...