Flowring Technology Agentflow BPM 代码问题漏洞

Flowring Technology Agentflow BPM is an enterprise process management system from Flowring Technology China. A code issue exists in Flowring Technology Agentflow BPM, which arises from an insufficient filtering of special characters in the url of the file upload function, which could allow an...

CVE-2022-3549

Summary: CVE-2022-3549 affects SourceCodester Simple Cold Storage Management System 1.0, specifically the Avatar Handler in /csms/admin/?page=user/manage_user (or similar path). The issue is an unrestricted file upload vulnerability within the Avatar Handler component, enabling remote attackers t...

CVE-2022-3129

A vulnerability was found in codeprojects Online Driving School. It has been rated as critical. Affected by this issue is some unknown functionality of the file /registration.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to...

PT-2022-24222 · Keysight · Keysight Sensor Management Server

Name of the Vulnerable Software and Affected Versions: Keysight Sensor Management Server SMS affected versions not specified Description: A path traversal issue exists in the addLicenseFile method of the com.keysight.tentacle.licensing.LicenseManager class. This allows an unauthenticated remote...

CVE-2022-36264

In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote Arbitrary File Upload vulnerability which allows overwriting arbitrary files. A malicious actor can remotely upload a file of their choice and overwrite any file in the system by manipulating the filename a...

CVE-2022-2647

CVE-2022-2647 affects jeecg-boot and enables unrestricted file upload via the /api/ path. The root cause appears to be insufficient input/file-type validation in the code path handling file arguments (e.g., Veracode cites lack of checks in FileTypeFilter.java). Public exploitation is noted in the...

CVE-2022-1574

WordPress HTML2WP plugin

Design/Logic Flaw

mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file system...

ThoughtWorks GoCD 路径遍历漏洞

ThoughtWorks GoCD is a free and open source CI/CD server from ThoughtWorks, Inc. A path traversal vulnerability exists in versions of ThoughtWorks GoCD prior to 21.3.0, which could be exploited by an attacker compromising the GoCD agent to upload malicious files to any directory on the GoCD serve...

CVE-2022-24652

sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in php code execution in /admin/upload/upload...

CVE-2022-24652

sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in php code execution in /admin/upload/upload...

Command injection

WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. This vulnerability impacts Fireware OS before 12.7.2U2, 12.x before 12.1.3U8, and 12.2.x through 12.5.x before 12.5.9U2...

Celartem Extensis Portfolio 代码问题漏洞

Celartem Extensis Portfolio is a digital asset management solution from Celartem Japan. A code issue vulnerability exists in Celartem Extensis Portfolio versions 3.0.0 through 3.6.3, which stems from insufficient validation of files during file uploads in the main portal. A remote user can upload...

WordPress Directorist plugin cross-site request forgery vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress Directorist plugin has a cross-site request forgery vulnerability, which stems from the fact that the WordPress...

CVE-2021-24981

The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory...

CVE-2021-24981

The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory...

CVE-2021-24981

The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory...

Cross site request forgery (csrf)

The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory...

CVE-2021-24981 Directorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File Upload

The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory...

CVE-2021-24981

The CVE-2021-24981 entry concerns the WordPress Directorist plugin (versions before 7.0.6.2). It describes a Cross-Site Request Forgery that enables Remote File Upload, leading to arbitrary PHP shell uploads in wp-content/plugins. Impact stated: shell upload and potential full site compromise; re...