CVE-2024-22567

Summary (CVE-2024-22567): A file-upload vulnerability in MCMS 5.3.5 allows an attacker to upload arbitrary files via a crafted POST to /ms/file/upload.do. The issue is documented across multiple sources (Red Hat, Veracode, GitHub advisory, OSV and others) and is rated with high impact (confidenti...

PT-2024-15110 · WordPress · File Manager Pro

Name of the Vulnerable Software and Affected Versions: File Manager Pro plugin for WordPress versions up to, and including, 8.3.4 Description: The issue allows authenticated attackers, with subscriber access and above, to execute code on the server via the mk check filemanager php syntax AJAX...

IBM Operational Decision Manager 代码问题漏洞

IBM Operational Decision Manager is a decision management solution from International Business Machines IBM used to help organizations better manage and enforce business rules and decisions. IBM Operational Decision Manager suffers from a code issue vulnerability that originates from the ability ...

Icons Font Loader < 1.1.5 - Authenticated(Administrator+) Arbitrary File Upload

Description The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in versions up to, and including, 1.1.4. This makes it possible for authenticated attackers, with administrator access and above, to upload...

The vulnerability of the RGWPostObj_ObjStore_S3::get_params() function (rgw_rest_s3.cc) in the RGW storage service of the Ceph system allows a attacker to circumvent security restrictions and upload arbitrary files.

The vulnerability of the RGWPostObjObjStoreS3::getparams function rgwrests3.cc in the RGW storage service of the Ceph system is related to deficiencies in access control when processing bucket keys. Exploiting this vulnerability allows an attacker to bypass security restrictions and upload...

Cisco Unity Connection Arbitrary File Upload (cisco-sa-cuc-unauth-afu-FROYsCsD)

According to its self-reported version, Cisco Unity Connection running on the report host is affected by an Arbitrary File Upload Vulnerability. Due to lack of authentication in a specific API and improper validation of user-supplied data, an unauthenticated, remote attacker can store malicious...

JobSearch WP Job Board < 2.3.4 - Arbitrary File Upload to RCE

Description The plugin does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server PoC Navigate to the site, and paste the following in your browser's console: fetch'/wp-admin/admin-ajax.php', method: 'POST', headers:...

JobSearch WP Job Board < 2.3.4 - Arbitrary File Upload to RCE

Description The plugin does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server Navigate to the site, and paste the following in your browser's console: fetch'/wp-admin/admin-ajax.php', method: 'POST', headers:...

The vulnerability of the backup/restore function of the video surveillance software Agent DVR allows a intruder to execute arbitrary code and upload arbitrary files.

The vulnerability of the Backup/Restore function of the video surveillance software for DVR systems is related to incorrect restrictions on the path to the restricted-access directory. Exploiting this vulnerability could allow an attacker to execute arbitrary commands and upload arbitrary files...

CVE-2024-24059

springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files...

CVE-2024-24059

springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files...

Design/Logic Flaw

springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files...

CVE-2024-24059

springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files...

CVE-2024-24059

Springboot-manager v1.6 is affected by an Arbitrary File Upload vulnerability caused by not filtering uploaded file suffixes. The reports consistently describe this as the root cause and outline the resulting security impact as arbitrary file upload with low confidentiality/integrity impact and n...

CVE-2024-24059

springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files...

CVE-2023-31505

An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information via a crafted .phtml file...

CVE-2024-1069

The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'viewpage' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to uploa...

CVE-2023-31505

An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information via a crafted .phtml file...

CVE-2023-31505

An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information via a crafted .phtml file...

WordPress is vulnerable to Arbitrary File Upload

Software WordPress Type WordPress Core Vulnerable versions 6.4.3 Fixed in 6.4.3 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2018-14028 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 87a72ffd6c73 Credits Vinicius Marangoni Required privilege...