CVE-2017-17593

Simple Chatting System 1.0 allows Arbitrary File Upload via view/myprofile.php, which places files under uploads/...

WordPress Cross-Site Scripting Vulnerability (CNVD-2017-38267)

WordPress is a blogging platform developed using the PHP language. Users can set up their own websites on servers that support PHP and MySQL databases, or use WordPress as a content management system CMS. A cross-site scripting vulnerability exists in WordPress before 4.9.1. The vulnerability...

CVE-2017-1000147

Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery CSRF attack on the uploader contained in Mahara's filebrowser widget. This could allow an attacker to trick a Mahara user into unknowingly uploading malicious files into...

MGASA-2017-0400 Updated tomcat packages fix security vulnerability

When running with HTTP PUTs enabled e.g. via setting the readonly initialization parameter of the Default servlet to false it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server...

Design/Logic Flaw

edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated users to upload arbitrary PHP files via a PHP file with a .gif extension in the userfile parameter...

CVE-2017-15285

X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is ...

IRCCloud: Missing robots exclusion header for user uploads

User uploaded text files can be linked from external websites and end up appearing in search engine result pages if you perform a search such as: site:.irccloud-cdn.com ext:txt It's not possible to completely prevent such listings on all search engines, but some search crawlers support the...

CVE-2017-14958

lib.php in PivotX 2.3.11 does not properly block uploads of dangerous file types by admin users, which allows remote PHP code execution via an upload of a .php file...

CVE-2017-13982

A directory traversal vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows users to upload unrestricted files...

Mojoomla Annual Maintenance Contract Management System Arbitrary File Upload Vulnerability

Mojoomla Annual Maintenance Contract AMC Management System is a contract document management system. An arbitrary file upload vulnerability exists in profilesetting image handling in the Mojoomla AMC Management System. A remote attacker can exploit this vulnerability to upload arbitrary files...

CVE-2017-14704

Multiple unrestricted file upload vulnerabilities in the 1 imageSubmit and 2 proofsubmit functions in Claydip Laravel Airbnb Clone 1.0 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in...

CVE-2017-14079

Unrestricted file uploads in Trend Micro Mobile Security Enterprise versions before 9.7 Patch 3 allow remote attackers to execute arbitrary code on vulnerable installations...

CVE-2017-14320

Mirasvit Helpdesk MX before 1.5.3 might allow remote attackers to execute arbitrary code by leveraging failure to filter uploaded files...

Code injection

Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files...

CVE-2017-1002016

Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files...

BlackCat CMS File Upload Vulnerability

BlackCat CMS is a content management system CMS based on PHP5 and HTML5 developed by Black Cat team. A security vulnerability exists in BlackCat CMS version 1.2.2, which stems from the program's failure to validate file extensions. The vulnerability can be exploited to upload files with extension...

The vulnerability of the SIP server Kamailio arises from the lack of restrictions on file uploads, allowing attackers to upload or transfer unreliable files.

The vulnerability of the SIP server Kamailio is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to upload or transfer unreliable files to the /tmp/kamailiofifo directory remotely...

batik: XML external entity processing vulnerability

An XXE vulnerability was found in Apache Batik which could allow a remote attacker to retrieve the files on the vulnerable server's filesystem by uploading specially crafted SVG images. The vulnerability could also allow a denial of service condition by performing an amplification attack...

batik: XML external entity processing vulnerability

An XXE vulnerability was found in Apache Batik which could allow a remote attacker to retrieve the files on the vulnerable server's filesystem by uploading specially crafted SVG images. The vulnerability could also allow a denial of service condition by performing an amplification attack...

Code injection

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code...