CVE-2017-9840

Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable application...

File upload vulnerability in finecms latest version v5.0.8

FineCMS is a content management system based on PHP+MySql. A file upload vulnerability exists in the swfupload function in Api.php in FineCMS version 5.0.8, which can be exploited by remote attackers to upload arbitrary files...

File Upload Vulnerability in FinecmsV5.0.8

FineCMS is a content management system based on PHP+MySql. A file upload vulnerability exists in Finecms V5.0.8, which exists in the file finecms\dayrui\controllers\Api.php. An attacker can exploit the vulnerability to upload arbitrary files...

KBVault MySQL Arbitrary File Upload Vulnerability

KBVault is a free knowledge base web application. An arbitrary file upload vulnerability exists in KBVault MySQL. An unauthenticated user can use the following URI: http://host/FileExplorer/Explorer.aspx?id=/Uploads访问文件上传 and delete function...

CVE-2017-9602

KBVault Mysql Free Knowledge Base application package 0.16a is affected by an arbitrary file upload vulnerability. The issue arises in the FileExplorer/Explorer.aspx component (id=/Uploads) which allows unauthenticated access to upload and delete functions. An attacker can upload an ASPX script t...

WordPress plugin "WP Job Manager" fails to restrict access permissions

Overview The WordPress plugin "WP Job Manager" provided by Automattic Inc. fails to restrict access permissions. Katsunori Kumagai of Kumasan, LLC. reported this issue to IPA under Information Security Early Warning Partnership. Impact A remote unauthenticated attacker may upload an image file to...

Schneider Electric U.motion Builder file_picker remote code execution vulnerability

U.motion Builder is a builder product from Schneider Electric France. A remote code execution vulnerability exists in Schneider Electric U.motion Builder filepicker. The user-specified upload path is not constrained, so any logged-in user can upload a file to any location in the system that is...

File Upload Vulnerability in Ctrip CMS (XerCMS) at Member Avatar Upload

Ctrip CMS XerCMS is a content management system based on php+mysql, integrating membership, community, guestbook, news and model management. XerCMS has a file upload vulnerability at the member avatar upload. Since the program uses a blacklist filtering mechanism for the filename suffix of the...

NIUSHOP open source mall system file upload vulnerability

NiuShop open source mall system is designed by Shanxi Niu Cool Information Technology Co., Ltd. independent design, research and development of a set of PHP open source e-commerce system . NIUSHOP open source mall system exists file upload vulnerability . Attackers can locally construct an upload...

Cross-site scripting vulnerability in FineCMS latest version 2.1.5

FineCMS is a content management system based on PHP+MySql. The latest version of FineCMS version 2.1.5 has a cross-site scripting vulnerability, the vulnerability stems from the front-end avatar uploads are not sufficiently filtered user-submitted inputs, an attacker can exploit the vulnerability...

UBUNTU-CVE-2017-9061

In WordPress before 4.7.5, a cross-site scripting XSS vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename...

DEBIAN-CVE-2017-9061

In WordPress before 4.7.5, a cross-site scripting XSS vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename...

CVE-2017-8080

Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads...

CVE-2017-8080

Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads...

Code injection

Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads...

CVE-2017-8080

CVE-2017-8080 affects Atlassian HipChat Server prior to 2.2.4. The issue allows remote authenticated users with user-level privileges to execute arbitrary code via vectors involving image uploads due to improper validation of uploaded images. An authenticated, remote attacker can exploit this by ...

CVE-2017-8080

Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads...

CVE-2016-5758

A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated uploads causing a high load...

CVE-2016-5758

A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated uploads causing a high load...

qdPM Arbitrary File Upload Vulnerability

qdPM is a free , open source based on Symfony framework using PHP and MySQL development project management system . An arbitrary file upload vulnerability exists in several pages in qdPM version 8.3. A remote attacker can exploit this vulnerability by sending a direct request to...