10057 matches found
Unrestricted file upload
Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the JCE component before 2.0.18 for Joomla! allows remote authenticated users with the author privileges to execute arbitrary PHP code by uploading a file with a double extension, as demonstrated by .php.gif. NOTE: so...
PT-2012-2112
Name of the Vulnerable Software and Affected Versions JCE component versions prior to 2.0.18 for Joomla! Description The issue allows remote authenticated users with author privileges to execute arbitrary PHP code by uploading a file with a double extension. This can be achieved by uploading a fi...
SA-CONTRIB-2012-133 - Taxonomy Image - Cross Site Scripting (XSS) & Arbitrary PHP code execution
The taxonomyimage module allows site administrators to associate images with taxonomy terms. The module did not sufficiently filter retrieval of taxonomy images, allowing users to bypass Drupal's normal file upload protections to install malicious HTML or executable code to the server. This...
CVE-2012-1641
The finderimport function in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote authenticated users with the administer finder permission to execute arbitrary PHP code via admin/build/finder/import...
CVE-2012-1641
The finderimport function in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote authenticated users with the administer finder permission to execute arbitrary PHP code via admin/build/finder/import...
PT-2012-3405
Name of the Vulnerable Software and Affected Versions Finder module versions 6.x-1.x before 6.x-1.26 Finder module versions 7.x-1.x Finder module versions 7.x-2.x before 7.x-2.0-alpha8 Description The issue allows remote authenticated users with the administer finder permission to execute arbitra...
CVE-2012-1641: Undefined Security Weakness
The finderimport function in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote authenticated users with the administer finder permission to execute arbitrary PHP code via admin/build/finder/import...
CVE-2012-4036
Unrestricted file upload vulnerability in admin.php in PBBoard 2.1.4 allows remote administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the addons directory. NOTE: this vulnerability can be leveraged b...
PT-2012-3664
Name of the Vulnerable Software and Affected Versions Newscoop versions 3.5.x through 3.5.4 Newscoop versions 4.0.0 through 4.0.RC3 Description The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This can be achieved by providing a URL in the GLOBALSg...
CVE-2010-5091
The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...
Code injection
The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...
CVE-2010-5091
The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...
CVE-2010-5091
The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...
CVE-2010-5091: Improper Control of Generation of Code
The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...
Tiki Wiki CMS Groupware jhot.php RCE Vulnerability
Tiki Wiki CMS Groupware is prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
WordPress Plugin Rich Widget - Arbitrary File Upload
source: https://www.securityfocus.com/bid/55174/info The Rich WidgetPlugin for WordPress is prone to an arbitrary file-upload vulnerability. An attacker can exploit this issue to upload arbitrary PHP code and run it in the context of the Web server process. This may facilitate unauthorized access...
WordPress Monsters Editor for WP Super Edit Plugin - Arbitrary File Upload
WordPress Monsters Editor for WP Super Edit plugin is prone to an arbitrary file upload vulnerability. It allows an attacker to upload arbitrary PHP code and run it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation. Solution Update the plugi...
WordPress Plugin Rich Widget - Arbitrary File Upload
WordPress Plugin Rich Widget - Arbitrary File Upload source: https://www.securityfocus.com/bid/55174/info The Rich WidgetPlugin for WordPress is prone to an arbitrary file-upload vulnerability. An attacker can exploit this issue to upload arbitrary PHP code and run it in the context of the Web...