PT-2021-19215 · Chiyu Technology · Bf-430 +2

Name of the Vulnerable Software and Affected Versions: CHIYU Technology Inc BF-430, BF-431, and BF-450M TCP/IP Converter devices affected versions not specified Description: A CRLF injection issue was discovered due to a lack of validation on the redirect= parameter available on multiple CGI...

CVE-2021-29641

Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file to the main upload directory and/or upload a .php file and a .htaccess file to a subdirectory. Exploitation succeeds only for certain...

CVE-2021-24161

In the Reponsive Menu free and Pro WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted si...

CVE-2021-24161

In the Reponsive Menu free and Pro WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted si...

CVE-2019-19020

An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an attacker to execute arbitrary code by overwriting existing files or adding new PHP files under the web root. This requires the attacker to ha...

PHP Scripts Mall Advance B2B Script Denial of Service Vulnerability

PHP Scripts Mall Advance B2B Script is a set of PHP-based scripts for B2B business-to-business trading websites. A denial of service vulnerability exists in PHP Scripts Mall Advance B2B Script 2.1.4, which can be exploited by remote attackers to cause a denial of service via JavaScript code in th...

portfolioCMS any.php file upload vulnerability

portfolioCMS is a content management system CMS based on PHP and MySQL. A security vulnerability exists in portfolioCMS version 1.0.5. An attacker can exploit the vulnerability to upload arbitrary .php files with the help of admin/portfolio.php?newpage=true URI...

Joomla! com_foxcontact plugin file upload vulnerability

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. A file upload vulnerability exists in the Joomla! comfoxcontact plugin, which can be exploited by remote attackers to upload malicious PHP scripts and execute arbitrary PHP code by...

Directory Traversal Vulnerability in Cicada Knowledge Enterprise Portal System

Cicada Knowledge Enterprise Portal System is a web content management system. A directory traversal vulnerability exists in Cicada Knowledge Enterprise Portal System. The vulnerability is due to improper handling of reading cached files and can be exploited by an attacker to read PHP files on the...

Synology Photo Station File Upload Vulnerability

Synology Photo Station is an online photo album and blog owned and managed by DSM users. A file upload vulnerability exists in PixlrEditorHandler.php in Synology Photo Station, which can be exploited by remote attackers to create arbitrary PHP scripts via the type parameter...

ManageEngine Desktop Central Remote Code Execution (CVE-2017-11346)

A remote Code Execution vulnerability exists in ManageEngine Desktop Central. The vulnerability is due to insufficient check of parameter. By sending crafted request ,a remote attacker can place a file under a directory that allows server-side scripts to run...

Contao Directory Traversal Vulnerability (CNVD-2017-25541)

Contao is an open source content management system CMS developed using PHP. The system supports search engine , rights management and CSS framework . A security vulnerability exists in Contao versions prior to 3.5.28 and 4.x versions prior to 4.4.1. A remote attacker can exploit the vulnerability...

ManageEngine Desktop Central 10 Build 100087 RCE(CVE-2017-11346)

Description: When uploading a file, the FileUploadServlet class does not check the user-controlled fileName parameter using hasVulnerabilityInFileName function. This allows a remote attacker to create a malicious file and place it under a directory that allows server-side scripts to run, which...

CMS Made Simple Upload Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMSMS version...

MetInfo Code Execution Vulnerability

MetInfo is a Content Management System CMS developed using PHP and Mysql. An arbitrary code execution vulnerability exists in MetInfo version 5.3.17. A remote attacker can exploit this vulnerability to create PHP scripts with malicious images...

CVE-2016-4897

Multiple cross-site scripting XSS vulnerabilities in 1 filter/saveforward.cgi, 2 filter/save.cgi, 3 /man/search.cgi in Usermin before 1.690...

HTTPD: sets environmental variable based on user supplied Proxy request header

It was discovered that httpd used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could...

Blade - A Webshell Connection Tool With Customized WAF Bypass Payloads

Blade is a webshell connection tool based on console, currently under development and aims to be a choice of replacement of Chooper 中国菜刀. Chooper is a very cool webshell client with widly typies of server side scripts supported, but Chooper can only work on Windows opreation system, so this is th...

ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability

This module exploits a vulnerability found in ManageEngine Desktop Central 9. When uploading a 7z file, the FileUploadServlet class does not check the user-controlled ConnectionId parameter in the FileUploadServlet class. This allows a remote attacker to inject a null bye at the end of the value ...

Cogent DataHub <= 7.1.1.63 Source Disclosure

No description provided by source. Luigi Auriemma Application: Cogent DataHub http://www.cogentdatahub.com/Products/CogentDataHub.html Versions: = 7.1.1.63 Platforms: Windows Bug: source disclosure Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma e-mail: [email protected] web:...