1850 matches found
Remote code execution
In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted...
PT-2019-14833
Name of the Vulnerable Software and Affected Versions Tiny File Manager versions prior to 2.3.9 Description The issue allows for remote code execution through the Upload from URL feature and the Edit/Rename files functionality. It affects only authenticated users. Recommendations For versions pri...
Cross site scripting
Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 tiki-adminsystem.php, 2 tiki-pagehistory.php, 3 tiki-removepage.php, or 4 tiki-renamepage.php...
OracleVM 3.4 : xen (OVMSA-2019-0054)
The remote OracleVM system is missing necessary patches to address critical security updates : - BUILDINFO: OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8 - BUILDINFO: xen commit=a3ec6768f487946b7316364bc9bd17ce4d752af5 - BUILDINFO: QEMU upstream...
November 19, 2019—KB4525242 (Preview of Monthly Rollup)
None None...
php: File rename across filesystems may allow unwanted access during processing
An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to...
WBCE CMS File Rename Filter Bypass Vulnerability
WBCE CMS is an open source content management system CMS based on PHP and MySQL. A security vulnerability exists in the admin/media/rename.php file in WBCE CMS 1.4.0 and earlier versions. An attacker can exploit the vulnerability to rename media file names and extensions to execute arbitrary PHP...
CVE-2019-17575
A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. For example: place PHP code in a .jpg file, and then change the file's base name to filename.p...
CVE-2019-17575
A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. For example: place PHP code in a .jpg file, and then change the file's base name to filename.p...
Code injection
A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. For example: place PHP code in a .jpg file, and then change the file's base name to filename.p...
CVE-2019-17575
CVE-2019-17575 applies to WBCE CMS 1.4.0 and earlier. A vulnerability in the admin/media/rename.php file forms a file-rename filter bypass, enabling an authenticated admin to rename a media file and extension in a way that results in executing arbitrary PHP code on the server. The documented exam...
CVE-2019-17575
A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. For example: place PHP code in a .jpg file, and then change the file's base name to filename.p...
Code injection
cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated SEC-517...
CVE-2009-0260
Multiple cross-site scripting XSS vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with 1 the rename parameter or 2 the drawing parameter aka the basename variable...
CVE-2019-15648
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber...
Information Disclosure
php is vulnerable to information disclosire. File rename across filesystems may allow unintended access to the file being renamed while the process is on-going...
php: File rename across filesystems may allow unwanted access during processing
An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to...
August 17, 2019—KB4512478 (Preview of Monthly Rollup)
None None...