Design/Logic Flaw

Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0...

CVE-2017-6104

CVE-2017-6104 concerns the WordPress plugin Mobile App Native 3.0, where the file upload endpoint at zen-mobile-app-native/server/images.php accepts uploads without authentication and without validating the file content. The vulnerability allows an attacker to upload arbitrary files (e.g., PHP sh...

CVE-2017-6104

Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0...

WordPress Mobile App Native 3.0 Shell Upload Vulnerability

WordPress Mobile App Native plugin version 3.0 suffers from a remote shell upload vulnerability. Title: Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0 Vulnerability Date: 2017-02-27 Download: https://wordpress.org/plugins/zen-mobile-app-native/ Vendor:...

Mobile App Native <= 3.0 - Remote File Upload

The code in file ./zen-mobile-app-native/server/images.php doesn't require authentication or check that the user is allowed to upload content. It also doesn't sanitize the file upload against executable code. $ curl -F "file=@/var/www/shell.php"...

Code injection

IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file...

CVE-2016-0214

IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file...

CVE-2016-0214

IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file...

CVE-2016-6104

IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, which could allow the attacker to execute arbitrary code on the vulnerable system...

CVE-2016-8931

IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server...

CVE-2016-8921

IBM FileNet WorkPlace XT could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server...

Brocade Network Advisor Directory Traversal Vulnerability (CNVD-2017-00701)

Brocade Network Advisor is a set of management tools for the entire network lifecycle from Brocade Communications Systems Brocade. A directory traversal vulnerability exists in the DashboardFileReceiveServlet in Brocade Network Advisor 14.0.2 and earlier versions. A remote attacker could exploit...

WordPress Slider Templatic Tevolution < 2.3.6 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Templatic = 2.3.6 Tevolution File Upload Vulnerability Date: 30-12-2016 Software Link: Permium plugin Vendor Homepage: https://templatic.com/wordpress-plugins/tevolution Exploit Author: r3m1ck Website:...

HPE Version Control Repository Manager File Upload Vulnerability

HPE Version Control Repository Manager VCRM is a repository for storing software and firmware that supports ProLiant servers from HewlettPackardEnterprise HPE, USA. A security vulnerability exists in HPE Version Control Repository Manager VCRM versions prior to 7.6. A remote attacker could exploi...

Design/Logic Flaw

Mailcwp remote file upload vulnerability incomplete fix v1.100...

CVE-2016-1000156

Mailcwp remote file upload vulnerability incomplete fix v1.100...

CVE-2016-1000156

Mailcwp remote file upload vulnerability incomplete fix v1.100...

CVE-2016-1000156

Mailcwp remote file upload vulnerability incomplete fix v1.100...

CVE-2016-1000156

CVE-2016-1000156 describes a remote file upload vulnerability in the MailCWP WordPress plugin. The vulnerability stems from incomplete/insufficient hardening of the file upload path, enabling an attacker to upload arbitrary files (potentially a web shell) to the WordPress site. Public references ...

WordPress Userpro Remote File Upload

Exploit Title : Wordpress Userpro Remote File Upload Exploit Author : Ashiyane Digital Security Team Vendor Homepage : http://userproplugin.com/ Google Dork : inurl:/wp-content/plugins/userpro/ Date : 10/20/2016 Tested on : Windows10/Linux This module requires Metasploit:...