CVE-2020-5880

Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server...

CVE-2019-18320

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. An attacker with network access to the Application Server could be able to upload arbitrary files without authentication. Please note that an attacker needs to have network access to the...

CVE-2019-18320

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. An attacker with network access to the Application Server could be able to upload arbitrary files without authentication. Please note that an attacker needs to have network access to the...

AUO SunVeillance Monitoring System 1.1.9e - Incorrect Access Control

Exploit for hardware platform in category web applications Exploit Title: AUO SunVeillance Monitoring System 1.1.9e - Incorrect Access Control Exploit Author: Luca.Chiou Vendor Homepage: https://www.auo.com/zh-TW Version: AUO SunVeillance Monitoring System all versions prior to v1.1.9e Tested on:...

AUO SunVeillance Monitoring System 1.1.9e - Incorrect Access Control

Exploit Title: AUO SunVeillance Monitoring System 1.1.9e - Incorrect Access Control Date: 2019-10-24 Exploit Author: Luca.Chiou Vendor Homepage: https://www.auo.com/zh-TW Version: AUO SunVeillance Monitoring System all versions prior to v1.1.9e Tested on: It is a proprietary devices:...

CVE-2019-16720

ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file...

CVE-2019-12150

Karamasoft UltimateEditor 1 is affected by CVE-2019-12150 due to improper validation of uploaded files: the system does not restrict file types or extensions, allowing an attacker to upload arbitrary files via the Attach icon. The uploaded file is stored under UltimateEditorInclude/UserFiles/ and...

CVE-2019-11231

An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows upload of files with arbitrary content PHP code, for example. This vulnerability is triggered by an authenticated user; however, authentication can be bypassed. According to th...

CVE-2019-11469

Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYSTEM on the server by uploading a malicious file via the "Execute Program Actions" feature...

CVE-2018-17926

The product M2M ETHERNET FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior is vulnerable in that an attacker can upload a malicious language file by bypassing the user authentication mechanism...

Magento Multiple Vulnerabilities (Nov 2018)

Magento is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:magentocommerce:magento"; if...

WordPress Share-Buttons 4.9.9 Shell Upload

Exploit Title : WordPress Share-Buttons Plugins 4.9.9 Remote Shell Upload Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 22/12/2018 Vendor Homepage : wordpress.org sbuttons.ru Software Download Link : atwebresults.com/phpajaximageupload/ +...

CVE-2018-18830

MCMS 4.6.5 is affected by a flaw in com\mingsoft\basic\action\web\FileAction.java where the upload interface does not verify login status, allowing an attacker to upload JSP content disguised as a .png file and then coerce a suffix change to .jsp to access a stored path and execute arbitrary JSP ...

CVE-2015-9266

CVE-2015-9266 affects Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (TOUGHSwitch). The web management interface allows an unauthenticated attacker to upload/write arbitrary files via directory traversal, potentially gaining root privileges. Affected products/versions were fixed in July ...

CVE-2018-9156

An issue was discovered on AXIS P1354 IP camera Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server modinclude modul...

CVE-2016-7845

CVE-2016-7845 affects GigaCC OFFICE (ver. 2.3 and earlier). The vulnerability allows remote attackers to upload arbitrary files as a user profile image, enabling potential unauthorized file sharing. The JVN/JVNDB entry and JVNDB-2017-001054 description corroborate an arbitrary file upload via the...

finecmsV5.0.8 \finecms\dayrui\controllers\Api.php getshell

Vulnerability in the C:\phpStudy\WWW\finecms\dayrui\controllers\Api. in php data2 function, approximately in the line 115, the problematic code about 178 rows public function data2 $data = array; // Route authentication if defined'SYSREFERER' && strlenSYSREFERER $http = $SERVER'HTTPREFERER' ?...

CVE-2015-8832

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a 1 .pht, 2 .php...

Ubiquiti Inc.: Can upload files without authentication on AirFibre 3.2

A POST submission such as below will upload a file to the tmp/upload directory without requiring authentication. I have been unable to redirect the upload to another directory so cannot utilize for RCE however an attacker is able to use this to fill the disk space on the device which could cause ...

Apache Jetspeed 目录穿越漏洞

通过管理员账号在后台 Portal Site Manger 处 import 恶意构造的 ZIP 文件,ZIP 压缩文件中包含名称为 ../../webapps/de.jsp 的文件,在后台处理 上传时会拼接此文件名导致目录穿越,控制文件上传路径。 poc.zip 包 含 名 为 ../../webapps/ROOT/de.jsp 的 文 件 , 内 容 为 is vulnerable: 上传后,即可在网站根目录根据目标环境决定访问到 de.jsp 文件: 要利用目录穿越上传任意文件虽然需要管理权限的账户,但是通过前一个漏 洞可以轻松创建一个拥有管理者权限的任意账户,再利用此漏洞上传...