CVE-2017-14399

In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\media\ajaxrename.php via the extension parameter, as demonstrated by changing the extension from .jpg to .php...

Unrestricted file upload

upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file...

CVE-2017-14346

upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file...

CVE-2017-14346

CVE-2017-14346 affects the tianchoy/blog package. The vulnerability exists in upload.php and allows an attacker to upload arbitrary files and execute PHP code by abusing image content-types (image/jpeg, image/pjpeg, image/png, image/gif) for a .php file, enabling remote code execution. Affected v...

CVE-2015-9228: Unrestricted Upload of File with Dangerous Type

In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php...

PT-2017-7556

Name of the Vulnerable Software and Affected Versions Photocrati NextGEN Gallery plugin version 2.1.10 Description The issue concerns unrestricted file upload in the Photocrati NextGEN Gallery plugin for WordPress. This is achieved by modifying the file extension, for example, from .jpg to .php,...

PT-2017-13442

Name of the Vulnerable Software and Affected Versions BlackCat CMS version 1.2.2 Description The issue allows for unrestricted file upload in the backend/media/ajax rename.php file via the extension parameter. This can be exploited by changing the file extension, for example, from .jpg to .php...

PT-2017-13407

Name of the Vulnerable Software and Affected Versions tianchoy/blog versions prior to 2017-09-12 Description The issue allows unrestricted file upload and PHP code execution. This can be achieved by using specific content types such as image/jpeg, image/pjpeg, image/png, or image/gif for a .php...

CVE-2017-14399: Unrestricted Upload of File with Dangerous Type

In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\media\ajaxrename.php via the extension parameter, as demonstrated by changing the extension from .jpg to .php...

CVE-2017-14346: Unrestricted Upload of File with Dangerous Type

upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file...

CVE-2017-14251

Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code...

CVE-2017-14251

TYPO3 Unrestricted File Upload vulnerability (CVE-2017-14251) affects TYPO3 7.6.0–7.6.21 and 8.0.0–8.7.4 due to the fileDenyPattern check in sysext/core/Classes/Core/SystemEnvironmentBuilder.php. Remote authenticated users can upload a .pht file and, as a result, execute arbitrary PHP code. The d...

CVE-2017-14251

Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code...

CVE-2017-14251: Unrestricted Upload of File with Dangerous Type

Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code...

PT-2017-13324

Name of the Vulnerable Software and Affected Versions TYPO3 versions 7.6.0 through 7.6.21 TYPO3 versions 8.0.0 through 8.7.4 Description The issue allows remote authenticated users to upload files with a .pht extension, which can lead to the execution of arbitrary PHP code due to an Unrestricted...

PT-2017-13177

Name of the Vulnerable Software and Affected Versions HPE BSM Platform Application Performance Management System Health versions 9.26, 9.30, 9.40 Description A directory traversal issue allows users to upload unrestricted files, potentially leading to security breaches. Recommendations For versio...

Hewlett Packard Enterprise Application Performance Management System Health UploadManager Servlet Directory Traversal Unrestricted File Upload Vulnerability

This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of Hewlett Packard Enterprise Application Performance Management System Health. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed...

CVE-2017-14123

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by...

CVE-2017-14123: Unrestricted Upload of File with Dangerous Type

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by...

PT-2017-13266

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Firewall Analyzer version 12200 Description The issue is related to an unrestricted File Upload vulnerability in the "Group Chat" section. This allows any user to upload files with any extensions. By uploading a PHP file to t...