Easy File Uploader 1.7 Shell Upload

==================================================================================================================================== | Title : Easy File Uploader 1.7 unrestricted file upload Vulnerability | | Author : indoushka | | Telegram : @indoushka | | Tested on : windows 10 FranASSais V.Pro...

PT-2018-10491

Name of the Vulnerable Software and Affected Versions Pluck versions prior to 4.7.6 Description An issue in the software allows for remote PHP code execution due to a missing set of disallowed file types for uploads, including .phtml and .htaccess. Recommendations For versions prior to 4.7.6,...

CVE-2018-11331: Unrestricted Upload of File with Dangerous Type

An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess...

BigTree CMS <= 4.2.22 Remote Upload & Code Execution Vulnerability

BigTree CMS is prone to a remote upload and code execution vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fastspot BigTree File Upload Vulnerability

Fastspot BigTree is the United States Fastspot company based on PHP and MySQL open source content management system CMS. Fastspot BigTree 4.2.22 and earlier versions of site/index.php/admin/trees/add/ has a security vulnerability , the vulnerability stems from core/inc/bigtree/apis/storage.php fi...

CVE-2018-10574

site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files...

CVE-2018-10574

site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files...

CVE-2018-10574: Improper Control of Generation of Code

site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files...

Code injection

The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file contents after SA-CORE-2013-003...

CVE-2014-5170

The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file contents after SA-CORE-2013-003...

CVE-2014-5170

The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file contents after SA-CORE-2013-003...

PT-2018-4259

Name of the Vulnerable Software and Affected Versions Drupal Storage API module versions prior to 7.x-1.6 Description The issue is related to the failure to update .htaccess file contents after a specific security update, which might allow remote attackers to execute arbitrary code. Recommendatio...

CVE-2014-5170: Improper Input Validation

The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file contents after SA-CORE-2013-003...

Apache .htaccess and .htpasswd Disclosure

The Apache server does not properly restrict access to .htaccess and/or .htpasswd files. A remote unauthenticated attacker can download these files and potentially uncover important information. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106231; scriptversion"1.5...

Wapiti 3.0.0 - The Web-Application Vulnerability Scanner

Wapiti allows you to audit the security of your websites or web applications. It performs "black-box" scans it does not study the source code of the web application by crawling the webpages of the deployed webapp, looking for scripts and forms where it can inject data. Once it gets the list of...

httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)

A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use this flaw to disclose portions of the server memory, or cause httpd child process to crash...

httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)

A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use this flaw to disclose portions of the server memory, or cause httpd child process to crash...

httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)

A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use this flaw to disclose portions of the server memory, or cause httpd child process to crash...

Synology Photo Station Information Disclosure Vulnerability (CNVD-2018-00112)

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. An information disclosure vulnerability exists in the default HTTP configuration file in Synology Photo Station versions prior to 6.8.1-3458 and prior to 6.3-2970. A remote attacker can exploit...

CVE-2017-12080

An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain sensitive system information via .htaccess file...