Zephyr 代码问题漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by the Zephyr Project. A security vulnerability exists in SmartBear Zephyr Enterprise version 7.15.0 and prior versions, which originates from a denial of service that allows unauthenticated users to upload large files, thereby...

SUSE CVE-2021-41868

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality...

CVE-2022-4395

The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE...

CVE-2022-45891

Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads Upload2.ashx or access content uploaded by other users View.aspx after Ajax.asmx/SaveGrantAccessList...

CVE-2022-45891

Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads Upload2.ashx or access content uploaded by other users View.aspx after Ajax.asmx/SaveGrantAccessList...

Authentication flaw

Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads Upload2.ashx or access content uploaded by other users View.aspx after Ajax.asmx/SaveGrantAccessList...

CVE-2022-45891

Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads Upload2.ashx or access content uploaded by other users View.aspx after Ajax.asmx/SaveGrantAccessList...

CVE-2022-45891

Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads Upload2.ashx or access content uploaded by other users View.aspx after Ajax.asmx/SaveGrantAccessList...

CVE-2022-45891

Planet eStream prior to version 6.72.10.07 contains critical vulnerabilities that allow an attacker to call restricted functions, perform unauthenticated uploads via Upload2.ashx, and access content uploaded by other users (View.aspx after Ajax.asmx/SaveGrantAccessList). The CVE entry cites unaut...

PT-2022-27670 · Unknown · Planet Estream

Name of the Vulnerable Software and Affected Versions: Planet eStream versions prior to 6.72.10.07 Description: The issue allows attackers to call restricted functions and perform unauthenticated uploads via the "Upload2.ashx" endpoint or access content uploaded by other users through "View.aspx"...

CVE-2022-3982

The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE...

CVE-2022-3912

The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example...

CVE-2022-3921

The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE...

PT-2022-24810 · WordPress · Listingo

Name of the Vulnerable Software and Affected Versions: Listingo WordPress theme versions prior to 3.2.7 Description: The issue concerns the lack of file validation for uploads via an AJAX action that is accessible to unauthenticated users. This could allow attackers to upload arbitrary files,...

PT-2022-24675 · M Files +1 · M-Files Hubshare +1

Name of the Vulnerable Software and Affected Versions: M-Files Hubshare versions prior to 3.3.11.3 Description: The issue concerns broken access controls on PDFtron WebviewerUI in M-Files Hubshare, allowing unauthenticated attackers to upload malicious files to the application server...

M-Files Hubshare 安全漏洞

M-Files Hubshare is a collaboration solution from M-Files, Inc. designed to seamlessly share files, documents and collaborative content. A security vulnerability exists in M-Files Hubshare versions prior to 3.3.11.3, which stems from poor access control in its PDFtron WebviewerUI allowing...

Simple Exam Reviewer Management System 代码问题漏洞

Simple Exam Reviewer Management System is a simple examiner management system. version 1.0 of Simple Exam Reviewer Management System is vulnerable to arbitrary file uploads, which stem from the lack of valid authentication of uploaded files on the configuration file page. An authenticated attacke...

PT-2022-22434 · Zengenti · Zengenti Contensis Classic

Name of the Vulnerable Software and Affected Versions: Zengenti Contensis Classic versions prior to 15.2.1.79 Description: The file upload wizard does not correctly check that a user has authenticated, allowing the execution of arbitrary commands by uploading a crafted aspx file. Recommendations:...

CVE-2022-2594

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration so PHP is not possible if there is a frontend form available. This vulnerability was introduced i...

CVE-2022-1574

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files such as PHP on the remote server...