CVE-2022-40050

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

Privilege escalation

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

CVE-2022-40050

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

CVE-2022-40050

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

CVE-2022-40050

CVE-2022-40050: ZFile v4.1.1 contains an arbitrary file upload vulnerability in the /file/upload/1 endpoint due to lack of validation. Documented impact includes potential remote code execution by uploading malicious files; explicit exploit details are not provided in all sources, but CNVD/CNNVD ...

CVE-2022-40050: Unrestricted Upload of File with Dangerous Type

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

PT-2022-25178 · Zfile · Zfile

Name of the Vulnerable Software and Affected Versions: ZFile version 4.1.1 Description: The issue is related to an arbitrary file upload vulnerability. It can be exploited via the /file/upload/1 API endpoint. Recommendations: For ZFile version 4.1.1, consider restricting access to the...

ZFile code-related vulnerabilities

ZFile is a Java-based online web development program open-sourced by zfile-dev. ZFile v4.1.1 contains an arbitrary file upload vulnerability that stems from a lack of validation of uploaded files in its component /file/upload/1. An attacker could exploit this vulnerability to upload malicious fil...

Ghostscript File Information Disclosure

The vulnerability of the zfile.c library of the PostScript/PDF Ghostscript interpreter is related to the state command, even when the dSAFER sandbox is used. Exploiting this vulnerability allows a remote attacker to determine the presence and size of arbitrary files...

DEBIAN-CVE-2018-11645

psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977...