WordPress wp-file-upload plugin code issue vulnerability

WordPress is a set of blogging platform developed by WordPress Foundation using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-file-upload is a file upload plugin used in it. A code issue vulnerability exists in the WordPress wp-file-upload plugin,...

Malicious Package

bb-builder is a malicious package. The package could run an executable targeting Windows and upload information to a remote server. Additionally an outside entity may gain full control of the computer via exploiting this malicious package...

CVE-2019-15127

REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file...

CVE-2019-15104

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...

CVE-2019-14794

The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders...

CVE-2019-14794

The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders...

Design/Logic Flaw

The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders...

CVE-2019-14794

CVE-2019-14794 affects the WordPress Meta Box plugin prior to version 4.16.2. The vulnerability arises from mishandling file uploads to custom folders, with a CVSS3 base score of 7.5 (network/vector, low access complexity, no privileges required, integrity impact HIGH). Public exploitation detail...

PT-2019-13823 · Backdrop · Backdrop Cms

Name of the Vulnerable Software and Affected Versions: Backdrop CMS versions 1.12.x through 1.12.7 Backdrop CMS versions 1.13.x through 1.13.2 Description: The issue allows the upload of entire-site configuration archives through the user interface or command line, without sufficiently checking...

CVE-2017-18387

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload SEC-314...

CVE-2018-20924

cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads SEC-378...

CVE-2018-20924

cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads SEC-378...

Design/Logic Flaw

cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads SEC-378...

CVE-2018-20924

cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads SEC-378...

The vulnerability of the automated personal data management system “Tula” lies in its ability to load files of a harmful type without limitation, allowing an attacker to execute arbitrary code.

The vulnerability of the automated personal data management system “Tula” is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading a specially crafted file onto the server using a specially crafted POST...

PT-2019-13687 · Veritas · Veritas Resiliency Platform

Name of the Vulnerable Software and Affected Versions: Veritas Resiliency Platform versions prior to 3.4 HF1 Description: An issue allows a user with sufficient privileges to overwrite any file in the virtual machine through a directory traversal vulnerability when uploading an application bundle...

LayerBB Code Issues Vulnerabilities

LayerBB is a small set of forum software. A code issue vulnerability exists in LayerBB version 1.1.3, which stems from the program not restricting the customlogo file name suffix. An attacker can exploit this vulnerability to upload arbitrary files...

RANGER Studio Directus Code Execution Vulnerability (CNVD-2019-39679)

RANGER Studio Directus is a set of open source headless CMS and API for managing custom databases from RANGER Studio, U.S.A. The Directus API is one of the components that can add a RESTful API layer to new or existing SQL databases. A security vulnerability exists in the RANGER Studio Directus 7...

CVE-2019-13979

In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads//originals remote code execution...

CVE-2019-13980

Directus 7 API (up to version 2.3.0) permits PHP uploads only when using Apache; with nginx, uploads/_/originals can lead to remote code execution. No exploitation details are provided in the given documents beyond this risk description. Remediation/patch details are not included in the connected...