CVE-2017-7357

Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by importing a file...

CVE-2017-7357

Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by importing a file...

Arbitrary file deletion

Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by importing a file...

CVE-2017-7357

CVE-2017-7357 affects Hipchat Server, specifically versions prior to 2.2.3. The vulnerability allows remote authenticated users with Server Administrator privileges to execute arbitrary code by importing a file. The issue is attributed to the Administrative Imports pathway, enabling code executio...

Dup Scout Enterprise v10.4.16 - Import Command Buffer Overflow

This module exploits a buffer overflow in Dup Scout Enterprise v10.4.16 by using the import command option to import a specially crafted xml file. Module Options msf use exploit/windows/fileformat/dupscout/xml msf undefinedxml show actions ...actions... msf undefinedxml set ACTION msf undefinedxm...

Directory traversal

Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and execute arbitrary JSP code via a .. dot dot in the X-File-Name header...

CVE-2017-5869

Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and execute arbitrary JSP code via a .. dot dot in the X-File-Name header...

PT-2017-16722

Name of the Vulnerable Software and Affected Versions Nuxeo Platform versions 6.0 through 7.3 Description The issue allows remote authenticated users to upload and execute arbitrary JSP code via a .. dot dot in the X-File-Name header, exploiting a directory traversal vulnerability in the file...

Elevation of Privilege Vulnerability in the background of emlog personal blog system

Short for every memory log, emlog is a PHP and MySQL based blog and CMS builder. A privilege elevation vulnerability exists in the background /src/admin/data.php page of the emlog personal blog system. An attacker can exploit the vulnerability to elevate privileges by importing files...

WordPress Plugin Add From Server 3.3.2 - Cross-Site Request Forgery (Arbitrary File Upload)

WordPress Plugin Add From Server 3.3.2 - Cross-Site Request Forgery Arbitrary File Upload Cross-Site Request Forgery vulnerability in Add From Server WordPress Plugin Abstract It was discovered that Add From Server is vulnerabile to Cross-Site Request Forgery. It can be exploited by luring the...

LMCMS Backend Arbitrary File Upload Vulnerability

LMCMS Leming CMS system is a web content management system developed in Java language, developed by Beijing Leming Zhixin Technology Co., Ltd. and distributed under commercial license. LMCMS Leming CMS system's management background under the full media library section of the file management to...

phpLiteAdmin 1.9.6 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: phpLiteAdmin v1.9.6 - Multiple Vulnerabilities Date: 20.04.2016 Exploit Author: Ozer Goker Vendor Homepage: https://www.phpliteadmin.org Software Link: https://bitbucket.org/phpliteadmin/public/downloads/phpLiteAdminv1-9-6.zip...

PT-2016-3914

Name of the Vulnerable Software and Affected Versions Cybozu Office versions 9.9.0 through 10.3.0 Description The issue allows remote authenticated users to cause a denial of service, specifically excessive database locking, by utilizing a crafted CSV file. Recommendations For Cybozu Office...

CVE-2014-9510

Cross-site request forgery CSRF vulnerability in the administration console in TP-Link TL-WR840N V1 router with firmware before 3.13.27 build 141120 allows remote attackers to hijack the authentication of administrators for requests that change router settings via a configuration file import...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the administration console in TP-Link TL-WR840N V1 router with firmware before 3.13.27 build 141120 allows remote attackers to hijack the authentication of administrators for requests that change router settings via a configuration file import...

CVE-2014-9510

Cross-site request forgery CSRF vulnerability in the administration console in TP-Link TL-WR840N V1 router with firmware before 3.13.27 build 141120 allows remote attackers to hijack the authentication of administrators for requests that change router settings via a configuration file import...

PT-2015-4255

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR840N version prior to 3.13.27 build 141120 Description A cross-site request forgery issue exists in the administration console, allowing remote attackers to hijack administrator authentication for requests that change router...

CVE-2014-9510: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the administration console in TP-Link TL-WR840N V1 router with firmware before 3.13.27 build 141120 allows remote attackers to hijack the authentication of administrators for requests that change router settings via a configuration file import...

Security Advisory-Multiple Vulnerabilities in Huawei eSpace Desktop Product

Huawei eSpace Desktop products have the following vulnerabilities: 1 The program does not implement comprehensive validity check on the QES file imported into the system, causing the system to exit unexpectedly. Vulnerability ID: HWPSIRT-2014-1151 This vulnerability has been assigned Common...

PT-2016-7007

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.x prior to 4.0.10.17 phpMyAdmin versions 4.4.x prior to 4.4.15.8 phpMyAdmin versions 4.6.x prior to 4.6.4 Description An issue was discovered where phpMyAdmin may not delete temporary files during the import of ESRI fil...