EUVD-2001-1489

Malware in sbrugna...

EUVD-2023-53628

Malicious code in bioql PyPI...

CVE-2013-5534

Directory traversal vulnerability in the attachment service in the Voice Message Web Service aka VMWS or Cisco Unity Web Service in Cisco Unity Connection allows remote authenticated users to create files, and consequently execute arbitrary JSP code, via a crafted pathname for a file that is not ...

CVE-2023-49694: Improper Access Control

A low-privileged OS user with access to a Windows host where NETGEAR ProSAFE Network Management System is installed can create arbitrary JSP files in a Tomcat web application directory. The user can then execute the JSP files under the security context of SYSTEM...

CVE-2021-26828: Unrestricted Upload of File with Dangerous Type

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via viewedit.shtm...

PT-2021-11044

Name of the Vulnerable Software and Affected Versions: openMAINT versions prior to 1.1-2.4.2 Description: The issue allows remote authenticated users to run arbitrary JSP code on the underlying web server. Recommendations: For versions prior to 1.1-2.4.2, update to version 1.1-2.4.2 or later to...

PT-2018-14679

Name of the Vulnerable Software and Affected Versions MCMS version 4.6.5 Description An issue was discovered in the FileAction.java file, where the upload interface does not verify the user login status, allowing files to be uploaded without setting a cookie. This can be exploited by uploading JS...

CVE-2018-18830: Unrestricted Upload of File with Dangerous Type

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

CVE-2018-10469

b3log Symphony aka Sym 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name parameter to the /upload URI...

CVE-2018-10469

b3log Symphony aka Sym 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name parameter to the /upload URI...

PT-2018-9888

Name of the Vulnerable Software and Affected Versions: b3log Symphony aka Sym version 2.6.0 Description: The issue allows remote attackers to upload and execute arbitrary JSP files. This is achieved via the name parameter to the "/upload" URI. Recommendations: For version 2.6.0, consider...

CVE-2018-10469: Unrestricted Upload of File with Dangerous Type

b3log Symphony aka Sym 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name parameter to the /upload URI...

CVE-2016-0300

IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 might allow remote attackers to access arbitrary JSP pages via vectors related to improper input validation. IBM X-Force ID: 111412...

CVE-2016-0300: Improper Input Validation

IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 might allow remote attackers to access arbitrary JSP pages via vectors related to improper input validation. IBM X-Force ID: 111412...

PT-2017-13253

Name of the Vulnerable Software and Affected Versions HiveManager Classic versions through 8.1r1 Description The issue allows arbitrary JSP code execution by modifying a backup archive before a restore. This is possible because the restore feature does not validate pathnames within the archive. A...

CVE-2017-14105

HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker – even restricted as a tenant – can add a jsp at...

CVE-2017-14105: Improper Input Validation

HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker - even restricted as a tenant - can add a jsp at...

CVE-2017-5869

Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and execute arbitrary JSP code via a .. dot dot in the X-File-Name header...

CVE-2017-5869

Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and execute arbitrary JSP code via a .. dot dot in the X-File-Name header...

PT-2017-16722

Name of the Vulnerable Software and Affected Versions Nuxeo Platform versions 6.0 through 7.3 Description The issue allows remote authenticated users to upload and execute arbitrary JSP code via a .. dot dot in the X-File-Name header, exploiting a directory traversal vulnerability in the file...