9965 matches found
PT-2019-14368
Name of the Vulnerable Software and Affected Versions SITOS six Build version 6.2.1 Description The issue allows unauthorized users to upload and import a SCORM 2004 package by directly accessing affected pages. An unauthenticated attacker could exploit the upload and import functionality to impo...
CVE-2019-15748: Unrestricted Upload of File with Dangerous Type
SITOS six Build v6.2.1 permits unauthorised users to upload and import a SCORM 2004 package by browsing directly to affected pages. An unauthenticated attacker could use the upload and import functionality to import a malicious SCORM package that includes a PHP file, which could execute arbitrary...
PT-2019-14371
Name of the Vulnerable Software and Affected Versions SITOS six Build version 6.2.1 Description The issue allows remote attackers to execute arbitrary code by uploading a SCORM file with an executable extension. An unauthenticated attacker can upload a malicious file, containing PHP code, to the...
PT-2019-15067
Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the MergeRecords module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...
PT-2019-15069
Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the Configurator module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...
PT-2019-15073
Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the Campaigns module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...
PT-2019-15068
Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the MergeRecords module by a Regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 o...
CVE-2019-17310: Improper Control of Generation of Code
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user...
CVE-2019-17188
An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restriction and upload PHP code to the webserver, by providing image data and the image/jpeg content type, with a .php extension. This occurs...
CVE-2019-17188
An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restriction and upload PHP code to the webserver, by providing image data and the image/jpeg content type, with a .php extension. This occurs...
Unrestricted file upload
An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restriction and upload PHP code to the webserver, by providing image data and the image/jpeg content type, with a .php extension. This occurs...
CVE-2019-17188
CVE-2019-17188 describes an unrestricted file upload in catalog/productinfo/imageupload of Fecshop/FecMall 2.3.4. An attacker can bypass front-end restrictions and upload PHP code to the webserver by supplying image data with image/jpeg content type and a .php extension, due to validation relying...
CVE-2019-17188
An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restriction and upload PHP code to the webserver, by providing image data and the image/jpeg content type, with a .php extension. This occurs...
CVE-2019-17188
An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restriction and upload PHP code to the webserver, by providing image data and the image/jpeg content type, with a .php extension. This occurs...
CVE-2008-5906
Eval injection vulnerability in the web interface plugin in KTorrent before 3.1.4 allows remote attackers to execute arbitrary PHP code via unspecified parameters to this interface's PHP scripts...
CVE-2008-4811
The expandquotedtext function in libs/SmartyCompiler.class.php in Smarty 2.6.20 r2797 and earlier allows remote attackers to execute arbitrary PHP code via vectors related to templates and a \ backslash before a dollar-sign character...
CVE-2019-17188: Unrestricted Upload of File with Dangerous Type
An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restriction and upload PHP code to the webserver, by providing image data and the image/jpeg content type, with a .php extension. This occurs...
PT-2019-14992
Name of the Vulnerable Software and Affected Versions Fecshop FecMall version 2.3.4 Description An issue was found where an attacker can bypass front-end restrictions and upload PHP code to the webserver. This is done by providing image data with a .php extension and the image/jpeg content type...