File Upload Vulnerability in Laike E-commerce System (CNVD-2020-01256)

Laike e-commerce with independent copyright system, is an integrated e-commerce system all the functions of the platform. A file upload vulnerability exists in the Laike Ecommerce system, which can be exploited by attackers to upload malicious files...

File Upload Vulnerability in Laikai Ecommerce System

Laike e-commerce with independent copyright system, is an integrated e-commerce system all the functions of the platform. A file upload vulnerability exists in the Laike Ecommerce system, which can be exploited by attackers to upload malicious files...

File upload vulnerability in myucms In***.php page

MyuCMS open source content management system developed using ThinkPHP community mall. A file upload vulnerability exists in the myucms In.php page, which can be exploited by attackers to upload malicious files...

Sonatype Nexus Repository Manager Remote Code Execution Vulnerability (CNVD-2019-37731)

Sonatype Nexus Repository Manager NXRM is a Maven repository manager from Sonatype USA. A remote code execution vulnerability exists in Sonatype NXRM, which can be exploited by an attacker to upload malicious files...

Access Control Error Vulnerability in Multiple Schneider Electric Products (CNVD-2019-34802)

Schneider Electric MEG6501-0001-U.motion KNX server and others are a web-based visualization system from Schneider Electric France. The system is mainly used for KNX-based home and building automation. An access control error vulnerability exists in multiple Schneider Electric products, which can...

CVE-2019-15843

A malicious file upload vulnerability was discovered in Xiaomi Millet mobile phones 1-6.3.9.3. A particular condition involving a man-in-the-middle attack may lead to partial data leakage or malicious file writing...

Mail.ru: [ RCE ] Through stopping the redirect in /admin/* the attacker able to bypass Authentication And Upload Malicious File

Combination of improper access control and unrestricted files upload in non-production service led to RCE possibility...

CVE-2019-15105

An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a...

CVE-2019-15104

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...

CVE-2019-15105

An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a...

ARMBot Botnet - Arbitrary Code Execution Vulnerability

import requests URL = "http://127.0.0.1/ARMBot/upload.php" r = requests.postURL, data = "file":"../publichtml/lol/../.s.phtml", need some trickery for each server ; "data":"PD9waHAgZWNobyAxOyA/Pg==", "message":"Bobr Dobr" , proxies="http":"127.0.0.1:8080","https":"127.0.0.1:8080" printr.statuscod...

Unspecified Vulnerability in RANGER Studio Directus

RANGER Studio Directus is a set of open source headless CMS and API for managing custom databases from RANGER Studio, U.S.A. The Directus API is one of the components that can add a RESTful API layer to new or existing SQL databases. A security vulnerability exists in the RANGER Studio Directus 7...

Magento Input Validation Error Vulnerability (CNVD-2019-39390)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A security vulnerability exists in Magento version 2.1 before 2.1.18, version 2.2 before 2.2.9, and version 2.3...

Design/Logic Flaw

BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmware Versions 1.3.2 and 1.6.1, Additionally, the following products using software Version 2.3.6 and below, Alaris GS, Alaris GH, Alaris CC,...

CVE-2019-10959

BD Alaris Gateway Workstation is affected by CVE-2019-10962 (unrestricted access to device status/config via web UI) and CVE-2019-10959 (unrestricted upload of dangerous file during firmware updates). Affected versions include various 1.x firmware/builds, with newer firmware 1.3.2 and 1.6.1 not i...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Malicious File Upload attack (CVE-2019-4056)

Summary IBM Maximo Asset Management Work Centers' application does not validate file type upon upload, allowing attackers to upload malicious files. Vulnerability Details CVEID: CVE-2019-4056 DESCRIPTION: IBM Maximo Asset Management Work Centers' application does not validate file type upon uploa...

CVE-2019-1821

A vulnerability in the web-based management interface of Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because t...

CVE-2019-1821 Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities

A vulnerability in the web-based management interface of Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because t...

PT-2019-2150 · Cisco · Cisco Evolved Programmable Network Manager +1

Name of the Vulnerable Software and Affected Versions: Cisco Prime Infrastructure affected versions not specified Cisco Evolved Programmable Network Manager affected versions not specified Description: The issue is related to improper validation of user-supplied input in the web-based management...

PhreeBooks ERP 5.2.3 - Arbitrary File Upload

PhreeBooks ERP v5.2.3 - Arbitrary File Upload Date: 03.04.2019 Exploit Author: Abdullah Çelebi Vendor Homepage: https://www.phreesoft.com/ Software Link: https://sourceforge.net/projects/phreebooks/files/latest/download Category: Webapps Version: 5.2.3 Tested on: WAMPP @Win Software description:...