Unrestricted file upload

Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file...

Trend Micro Mobile Security for Enterprise upload_font_file Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Mobile Security for Enterprise. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of the uploadfontfile action. The issue results...

Trend Micro Mobile Security for Enterprise upload_app_file Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Mobile Security for Enterprise. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of the uploadappfile action. The issue results...

Trend Micro Mobile Security for Enterprise upload_wallpaper_file Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Mobile Security for Enterprise. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of the uploadwallpaperfile action. The issue...

WordPress NextGEN Gallery Plugin < 2.1.15 Malicious File Upload Vulnerability

The WordPress plugin Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

Unrestricted file upload

In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\media\ajaxrename.php via the extension parameter, as demonstrated by changing the extension from .jpg to .php...

CVE-2017-14346

upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file...

Unrestricted file upload

upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file...

CVE-2017-14346

CVE-2017-14346 affects the tianchoy/blog package. The vulnerability exists in upload.php and allows an attacker to upload arbitrary files and execute PHP code by abusing image content-types (image/jpeg, image/pjpeg, image/png, image/gif) for a .php file, enabling remote code execution. Affected v...

CVE-2017-14251

Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code...

CVE-2017-14251

TYPO3 Unrestricted File Upload vulnerability (CVE-2017-14251) affects TYPO3 7.6.0–7.6.21 and 8.0.0–8.7.4 due to the fileDenyPattern check in sysext/core/Classes/Core/SystemEnvironmentBuilder.php. Remote authenticated users can upload a .pht file and, as a result, execute arbitrary PHP code. The d...

Hewlett Packard Enterprise Application Performance Management System Health UploadManager Servlet Directory Traversal Unrestricted File Upload Vulnerability

This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of Hewlett Packard Enterprise Application Performance Management System Health. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed...

CVE-2017-14123

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by...

CVE-2014-9312

CVE-2014-9312 : WordPress Photo Gallery plugin (version 1.2.5) contains an Unrestricted File Upload vulnerability. The root cause is UploadHandler.php allowing access to file uploads without proper verification/sanitization, enabling an attacker with a registered user account to upload arbitrary ...

ALC WebCTRL i-Vu/SiteScan Web File Unrestricted File Upload Vulnerability

ALC WebCTRL is the building automation platform. ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior versions are vulnerable to an unrestricted file upload vulnerability that could allow an authenticated user to upload malicious files and execute code...

Automated Logic WebCTRL 6.5 Unrestricted File Upload Remote Code Execution Exploit

Automated Logic WebCTRL version 6.5 suffers from an unrestricted file upload vulnerability that allows for remote code execution. !/usr/bin/env python -- coding: utf8 -- Automated Logic WebCTRL 6.5 Unrestricted File Upload Remote Code Execution Vendor: Automated Logic Corporation Product web page...

Automated Logic WebCTRL 6.5 Unrestricted File Upload Remote Code Execution

!/usr/bin/env python -- coding: utf8 -- Automated Logic WebCTRL 6.5 Unrestricted File Upload Remote Code Execution Vendor: Automated Logic Corporation Product web page: http://www.automatedlogic.com Affected version: ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior ALC WebCTRL, SiteScan Web 6.1 and...

Automated Logic WebCTRL 6.5 - Unrestricted File Upload Remote Code Execution

Automated Logic WebCTRL 6.5 - Unrestricted File Upload Remote Code Execution !/usr/bin/env python -- coding: utf8 -- Automated Logic WebCTRL 6.5 Unrestricted File Upload Remote Code Execution Vendor: Automated Logic Corporation Product web page: http://www.automatedlogic.com Affected version: ALC...

Automated Logic WebCTRL 6.5 Unrestricted File Upload Remote Code Execution

Summary WebCTRL®, Automated Logic's web-based building automation system, is known for its intuitive user interface and powerful integration capabilities. It allows building operators to optimize and manage all of their building systems - including HVAC, lighting, fire, elevators, and security -...

CVE-2017-11154

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter...