Zoho ManageEngine ServiceDesk Plus (SDP) < 10.0 build 10012 - Arbitrary File Upload Vulnerability

Exploit for jsp platform in category web applications...

CVE-2019-7684

inxedu through 2018-12-24 has a vulnerability that can lead to the upload of a malicious JSP file. The vulnerable code location is com.inxedu.os.common.controller.VideoUploadControllergok4 com/inxedu/os/common/controller/VideoUploadController.java. The attacker uses the /video/uploadvideo fileTyp...

Code injection

inxedu through 2018-12-24 has a vulnerability that can lead to the upload of a malicious JSP file. The vulnerable code location is com.inxedu.os.common.controller.VideoUploadControllergok4 com/inxedu/os/common/controller/VideoUploadController.java. The attacker uses the /video/uploadvideo fileTyp...

CVE-2019-7684

inxedu through 2018-12-24 has a vulnerability that can lead to the upload of a malicious JSP file. The vulnerable code location is com.inxedu.os.common.controller.VideoUploadControllergok4 com/inxedu/os/common/controller/VideoUploadController.java. The attacker uses the /video/uploadvideo fileTyp...

CVE-2019-7684

The CVE-2019-7684 entry describes a vulnerability in inxedu (through 2018-12-24) where the file upload logic in VideoUploadController#gok4 (com/inxedu/os/common/controller/VideoUploadController.java) uses the /video/uploadvideo fileType parameter to control allowed extensions. An attacker can mod...

CVE-2019-7684

inxedu through 2018-12-24 has a vulnerability that can lead to the upload of a malicious JSP file. The vulnerable code location is com.inxedu.os.common.controller.VideoUploadControllergok4 com/inxedu/os/common/controller/VideoUploadController.java. The attacker uses the /video/uploadvideo fileTyp...

Unrestricted File Upload

tomcat-catalina is vulnerable to remote code execution RCE attacks. On a Windows system with HTTP PUTs enabled a malicious user can upload a JSP file to the server which would then be executed...

Adobe Coldfusion 11 CKEditor Arbitrary File Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Adobe ColdFusion CKEditor unrestricted file upload', 'Description' = %q A file upload vulnerability in the CKEditor of Adobe ColdFusion 11 Update...

Adobe Coldfusion 11 CKEditor Arbitrary File Upload Exploit

A file upload vulnerability exists in the CKEditor of Adobe ColdFusion 11 Update 14 and earlier. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Adobe ColdFusion CKEditor unrestricted file...

VulnCheck KEV: CVE-2017-12615

When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server...

Adobe ColdFusion CKEditor unrestricted file upload

A file upload vulnerability in the CKEditor of Adobe ColdFusion 11 Update 14 and earlier, ColdFusion 2016 Update 6 and earlier, and ColdFusion 2018 July 12 release allows unauthenticated remote attackers to upload and execute JSP files through the filemanager plugin. Tested on Adobe ColdFusion...

CVE-2018-19822

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "/VPortal/mgtconsole/SharedCriteria.jsp" has reflected XSS via the ConnPoolName or GroupId parameter...

CVE-2018-19773

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "EditCurrentUser.jsp" has reflected XSS via the GroupId and ConnPoolName parameters...

CVE-2018-19816

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "/VPortal/mgtconsole/categorytree/ChooseCategory.jsp" has reflected XSS via the ConnPoolName parameter...

CVE-2018-19811

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "/VPortal/mgtconsole/Import.jsp" has reflected XSS via the ConnPoolName parameter...

CVE-2018-19772

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "EditCurrentPresentSpace.jsp" has reflected XSS via the ConnPoolName, GroupId, and ParentId parameters...

CVE-2018-19649

XSS exists in InfoVista VistaPortal SE Version 5.1 build 51029. VPortal/mgtconsole/RolePermissions.jsp has reflected XSS via the ConnPoolName parameter...

CVE-2018-19767

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "PresentSpace.jsp" has reflected XSS via the ConnPoolName and GroupId parameters...

Infovista VistaPortal SE Cross-Site Scripting Vulnerability (CNVD-2019-07220)

Infovista VistaPortal SE is a Web-based application from Infovista USA. A cross-site scripting vulnerability exists in the /VPortal/mgtconsole/GroupMove.jsp page in Infovista VistaPortal SE version 5.1 build 51029, which can be exploited by a remote attacker to inject arbitrary Web code with the...

Dotcms cross-site scripting vulnerability (CNVD-2018-26792)

dotCMS is a content management system CMS from the United States dotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A cross-site scripting vulnerability exists in dotCMS 5.0.3 and earlier versions. A remote attacker can leverage t...