EUVD-2017-16453

Malware in sbrugna...

EUVD-2000-1040

Malware in sbrugna...

EUVD-2017-5617

Malware in sbrugna...

EUVD-2012-3325

Malware in sbrugna...

CVE-2021-28023

Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths...

CVE-2021-28023

Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths...

Design/Logic Flaw

Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths...

CVE-2021-28023

Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths...

PT-2021-17712

Name of the Vulnerable Software and Affected Versions: ServiceTonic Helpdesk software version 9.0.35937 Description: The issue allows a malicious user to execute JSP code by uploading a zip file that extracts files in relative paths, leveraging the arbitrary file upload in the Service import...

GHSA-C7C7-XM8G-XM36 Unrestricted Upload of File with Dangerous Type in mingsoft:ms-mcms

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

CVE-2018-18830: Unrestricted Upload of File with Dangerous Type

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

PT-2018-14679

Name of the Vulnerable Software and Affected Versions MCMS version 4.6.5 Description An issue was discovered in the FileAction.java file, where the upload interface does not verify the user login status, allowing files to be uploaded without setting a cookie. This can be exploited by uploading JS...

CVE-2017-7429: Unrestricted Upload of File with Dangerous Type

The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server...

CVE-2017-14105

HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker - even restricted as a tenant - can add a jsp at...

Design/Logic Flaw

HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker - even restricted as a tenant - can add a jsp at...

PT-2017-13253

Name of the Vulnerable Software and Affected Versions HiveManager Classic versions through 8.1r1 Description The issue allows arbitrary JSP code execution by modifying a backup archive before a restore. This is possible because the restore feature does not validate pathnames within the archive. A...

CVE-2017-14105

HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker – even restricted as a tenant – can add a jsp at...

CVE-2017-14105: Improper Input Validation

HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker - even restricted as a tenant - can add a jsp at...

Directory traversal

Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and execute arbitrary JSP code via a .. dot dot in the X-File-Name header...

PT-2017-16722

Name of the Vulnerable Software and Affected Versions Nuxeo Platform versions 6.0 through 7.3 Description The issue allows remote authenticated users to upload and execute arbitrary JSP code via a .. dot dot in the X-File-Name header, exploiting a directory traversal vulnerability in the file...