1177 matches found
CVE-2018-13299
Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename parameter...
Sitemagic CMS Cross-Site Scripting Vulnerability
Sitemagic CMS is a scalable content management system CMS. A cross-site scripting vulnerability exists in the SMFiles/FrmUpload.class.php file in Sitemagic CMS v4.4, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'filename' parameter...
CVE-2019-10238
Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter...
CVE-2019-10238
Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter...
CVE-2019-10238: Improper Neutralization of Input During Web Page Generation
Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter...
Humhub cross-site scripting vulnerability (CNVD-2019-12169)
Humhub is a set of open source social networking software based on the Yii PHP framework written . A cross-site scripting vulnerability exists in file/file/upload in version 1.3.10 of Humhub Community Edition. A remote attacker can use the 'filename' parameter to inject arbitrary web script or HT...
Deserialization of Untrusted Data
Overview pimcore/pimcore is a content & product management framework CMS/PIM/E-Commerce. Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It is possible insert the php wrapper “phar” with an arbitrary path in filename parameter that allows arbitrary code...
CVE-2019-9093: Improper Neutralization of Input During Web Page Generation
A Reflected Cross Site Scripting XSS Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing a JavaScript payload in the filename parameter is echoed back, which resulted in reflected XSS...
PT-2019-9645 · Netdata +4 · Netdata +4
Name of the Vulnerable Software and Affected Versions: Netdata version 1.10.0 Description: An issue exists in the software where HTTP Header Injection is possible via the filename parameter in the "api/v1/data" endpoint. This is due to the web client api request v1 data function in web/api/web ap...
Design/Logic Flaw
ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request...
CVE-2019-9632
ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request...
CVE-2019-9632
CVE-2019-9632 affects ESAFENET CDG V3 and V5. The vulnerability enables arbitrary file download via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request. Reported impact is information disclosure; CVSSv3 base score 7.5 (HI...
CVE-2019-9632: Undefined Security Weakness
ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request...
CVE-2019-8407
HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI...
CVE-2019-8407: Improper Limitation of a Pathname to a Restricted Directory
HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI...
NEC Aterm HC100RC OS Command Injection Vulnerability (CNVD-2019-01107)
The NEC Aterm HC100RC is a network camera from Nippon Electric NEC. An operating system command injection vulnerability exists in the NEC Aterm HC100RC using firmware version 1.0.1 and earlier. The vulnerability can be exploited to execute arbitrary operating system commands with the 'filename'...
CVE-2018-0635
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter...
CVE-2018-0635
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter...
CVE-2018-0635: Improper Neutralization of Special Elements used in an OS Command
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter...