Arbitrary file upload vulnerability in GeoServer's REST Coverage Store API

Summary An arbitrary file upload vulnerability exists that enables an authenticated administrator with permissions to modify coverage stores through the REST Coverage Store API to upload arbitrary file contents to arbitrary file locations which can lead to remote code execution. Details Coverage...

GHSA-9V5Q-2GWQ-Q9HQ Arbitrary file upload vulnerability in GeoServer's REST Coverage Store API

Summary An arbitrary file upload vulnerability exists that enables an authenticated administrator with permissions to modify coverage stores through the REST Coverage Store API to upload arbitrary file contents to arbitrary file locations which can lead to remote code execution. Details Coverage...

CVE-2024-1205

The Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the nouvellouploadcsvfile function in all versions up to, and including, 1.2.0. This...

CVE-2024-1205

The Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the nouvellouploadcsvfile function in all versions up to, and including, 1.2.0. This...

Lektor Static CMS 3.3.10 Arbitrary File Upload / Remote Code Execution Vulnerabilities

Lektor Static CMS version 3.3.10 suffers from an arbitrary file upload vulnerability that can be leveraged to achieve remote code execution. Exploit Title: Lektor static content management system Version: 3.3.10 Arbitrary File upload Exploit Author: kai6u Vendor Homepage: https://www.getlektor.co...

PT-2024-17417 · WordPress · The Management App For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring plugin for WordPress version 1.2.0 and earlier Description: The issue is related to arbitrary file uploads due to missing file type...

Lektor Static CMS 3.3.10 Arbitrary File Upload / Remote Code Execution

Exploit Title: Lektor static content management system Version: 3.3.10 Arbitrary File upload Date: 20/03/2024 Exploit Author: kai6u Vendor Homepage: https://www.getlektor.com/ Software Link: https://github.com/lektor/lektor/releases/tag/v3.3.10 Version: 3.3.10 Tested on: Ubuntu 22.04 Summary:...

PT-2024-14126 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.23.4 and 2.24.1 Description: An arbitrary file upload vulnerability exists that enables an authenticated administrator with permissions to modify coverage stores through the "REST Coverage Store API" to upload...

Zippy < 1.6.10 - Authenticated (Editor+) Arbitrary File Upload

Description The Zippy plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ZippyCore.php file in all versions up to, and including, 1.6.9. This makes it possible for authenticated attackers, with editor-level access and above, to upload arbitrary...

Lektor Code Issue Vulnerability

Lektor is a Lektor open source static file content management system. A code issue vulnerability exists in Lektor version 3.3.10, which stems from an arbitrary file upload issue...

CVE-2024-29135 WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through = 2.11.15...

CVE-2024-29135 WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through = 2.11.15...

WordPress Tourfic Plugin <= 2.11.15 is vulnerable to Arbitrary File Upload

Software Tourfic Type Plugin Vulnerable versions = 2.11.15 Fixed in 2.11.16 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-29135 Patch priority High CVSS severity High 9.9 Developer Themefic PSID b543d4424f73 Credits LVT-tholv2k Required privilege Subscriber Publishe...

Cisco Unified IP Phone 9900 Series Arbitrary File Upload (CVE-2015-0604)

The web framework on Cisco Unified IP 9900 phones with firmware 9.4.1 and earlier allows remote attackers to upload files to arbitrary locations on a phone's filesystem via crafted HTTP requests, aka Bug ID CSCup90424. This plugin only works with Tenable.ot. Please visit...

CVE-2024-27957 WordPress Pie Register plugin <= 3.8.3.1 - Unauthenticated Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Pie Register.This issue affects Pie Register: from n/a through 3.8.3.1...

CVE-2024-27957 WordPress Pie Register plugin <= 3.8.3.1 - Unauthenticated Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Pie Register.This issue affects Pie Register: from n/a through 3.8.3.1...

CVE-2024-28424

zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpicklematerializer.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-28423

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafeload function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file...

CVE-2024-28425

greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the loadobj function at /templates/pickleutils.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file...

PYSEC-2024-315

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafeload function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file...