CVE-2019-1888

A vulnerability in the Administration Web Interface of Cisco Unified Contact Center Express Unified CCX could allow an authenticated, remote attacker to upload arbitrary files and execute commands on the underlying operating system. To exploit this vulnerability, an attacker needs valid...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the vulnerable server. This vulnerability is due to an incomplete fix for CVE-2020-4470. IBM X-Force ID: 187188...

PT-2020-11986

Name of the Vulnerable Software and Affected Versions vtecrm vtenext version 19 CE Description A CSRF issue allows attackers to carry out unwanted actions on an administrator's behalf, such as uploading files, adding users, and deleting accounts. Recommendations For vtecrm vtenext version 19 CE,...

CVE-2020-3478 Cisco Enterprise NFV Infrastructure Software File Overwrite Vulnerability

A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device. The vulnerability is due to insufficient authorization enforcement on an affected system...

CVE-2020-14065

IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space...

File Upload Vulnerability in Hangzhou Vickers Club Network Technology Co.

Hangzhou Vickers Club Network Technology Co., Ltd. is a website builder. A file upload vulnerability exists in the website builder system of Hangzhou Vickers Club Network Technology Co. Ltd, which can be exploited by attackers to upload arbitrary files...

The vulnerability of the software for the Zoho ManageEngine ServiceDesk Plus IT support service lies in the lack of restrictions on file uploads, allowing attackers to upload any files they desire.

The vulnerability of the Zoho ManageEngine ServiceDesk Plus software lies in the lack of restrictions on the upload of files. Exploiting this vulnerability allows a malicious actor to upload any files using the login page settings...

CVE-2020-11701

An issue was discovered in ProVide formerly zFTPServer through 13.1. CSRF exists in the User Web Interface, as demonstrated by granting filesystem access to the public for uploading and deleting files and directories...

CVE-2019-16064

NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and directories stored outside of the web root folder. By exploiting this vulnerability, it is possible for an attacker to list operating-system directory...

CVE-2019-4130

IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-Force ID: 158280...

Input validation

Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an attacker can exploit this vulnerability by sending special constructed packets to obtain files in the device and upload files to some directories...

Atlassian Confluence 6.15.1 Directory Traversal

Exploit Title: Atlassian Confluence 6.15.1 - Directory Traversal Google Dork: N/A Date: 2019-11-11 Exploit Author: max7253 Vendor Homepage: https://www.atlassian.com Software Link: https://www.atlassian.com/software/confluence/download-archives Version: 6.15.1 Tested on: Microsoft Windows 7...

Koji Path Traversal Vulnerability

Koji is an RPM build system. A path traversal vulnerability in Koji 1.18.0 and earlier versions can be exploited by an attacker to upload a file to an arbitrary location...

CVE-2007-6685

Unspecified vulnerability in the Publish XP module Menalto Gallery before 2.2.4 allows attackers to create albums and upload files via unknown vectors...

F5 Networks BIG-IP : F5 tmsh vulnerability (K40378764)

"Authenticated users with the ability to upload files via scp, for example can escalate their privileges to allow root shell access from within the TMOS Shell tmsh interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp . CVE-2019-6642 Impact...

Pydio Cells Elevation of Privilege Vulnerability

Pydio Cells is a transition application for managing files on a Pydio Cells 1.2.X server. An elevation of privilege vulnerability exists in versions of Pydio Cells prior to 1.5.0, which stems from Pydio Cells failing to neutralize the... /element, which can be exploited by an attacker with very l...

Privilege escalation

Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an unprivileged directory, leading to Privilege escalation...

CVE-2019-12901: Improper Limitation of a Pathname to a Restricted Directory

Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an unprivileged directory, leading to Privilege escalation...

Design/Logic Flaw

Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used to upload files...

PT-2019-7902

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Application Manager version 13.1 Build 13100 Description The issue allows an administrative user to upload files or binaries that can be executed when an alarm occurs. An attacker can exploit this functionality by uploading a...