547 matches found
CVE-2023-52252
Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint...
Design/Logic Flaw
Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint...
CVE-2023-52252
CVE-2023-52252 affects Unified Remote 3.13.0. The root cause is a wildcarded Access-Control-Allow-Origin header on the Remote upload endpoint, enabling remote attackers to execute arbitrary Lua code. The impact reported is remote code execution with high confidentiality/integrity/availability ris...
CVE-2023-52252
Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint...
PT-2023-31943 · Unknown · Unified Remote
Name of the Vulnerable Software and Affected Versions: Unified Remote version 3.13.0 Description: The issue allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the "Remote upload endpoint". Recommendations: For Unified Remote version 3.13....
PT-2023-6688 · Bitrix · Bitrix24
Name of the Vulnerable Software and Affected Versions: Bitrix24 version 22.0.300 Description: The issue is related to the lack of a mime type response header in Bitrix24, which allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser. If the victim has...
Design/Logic Flaw
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint /upload which handles request with the filename parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can...
PT-2023-28995 · Arduino · Arduino Create Agent
Name of the Vulnerable Software and Affected Versions: Arduino Create Agent versions prior to 1.3.3 Description: The issue affects the endpoint "/upload" which handles requests with the filename parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able ...
CVE-2023-4613
This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/settings/upload endpoint. The issue results from the lack of proper validation...
PT-2023-29580 · Unknown · Bettershop Laiketui
Name of the Vulnerable Software and Affected Versions: Bettershop LaikeTui affected versions not specified Description: A critical issue has been found in Bettershop LaikeTui, affecting some unknown functionality of the file "index.php?module=api&action=user&m=upload" of the component POST Reques...
LaikeTui 代码问题漏洞
LaikeTui Laike e-commerce is a stable and small open source mall system for individual developers. Bettershop LaikeTui code problem vulnerability , the vulnerability stems from the component POST Request Handler in the index.php?module=api&action=user&m=upload there are some unknown functions ,...
LG LED Assistant upload Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/settings/upload endpoint. The issue results from the lack of proper validation...
Uvdesk v1.1.3 - File Upload Remote Code Execution (Authenticated) Exploit
Exploit Title: Uvdesk v1.1.3 - File Upload Remote Code Execution RCE Authenticated Exploit Author: Daniel Barros @cupc4k3d - Hakai Offensive Security Vendor Homepage: https://www.uvdesk.com Software Link: https://github.com/uvdesk/community-skeleton Version: 1.1.3 Example: python3 CVE-2023-39147....
PT-2023-26063 · Unknown · Fast-Poster
Name of the Vulnerable Software and Affected Versions: fast-poster version 2.15.0 Description: The issue concerns a Cross Site Scripting XSS problem. Specifically, it involves the upload of files, where the check for image files is performed based on binary data but does not strictly verify the...
PT-2023-25490 · Suncreate · Suncreate Mountain Flood Disaster Prevention Monitoring/Early Warning System
Name of the Vulnerable Software and Affected Versions: Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System versions up to 20230704 Description: A critical issue affects some unknown functionality of the file /Duty/AjaxHandle/UploadHandler.ashx of the component Duty...
CVE-2023-34833
An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file...
CVE-2023-34833
An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file...
PT-2023-25019 · Unknown · Thinkadmin
Name of the Vulnerable Software and Affected Versions: ThinkAdmin version 6 Description: An arbitrary file upload issue in the "api/upload.php" endpoint allows attackers to execute arbitrary code via a crafted file. Recommendations: For ThinkAdmin version 6, consider disabling the /api/upload.php...
ThinkAdmin 代码问题漏洞
ThinkAdmin is a general-purpose backend management system based on ThinkPHP framework. ThinkAdmin v6 version has a security vulnerability, the vulnerability stems from /api/upload.php in the existence of arbitrary file upload vulnerability, an attacker can be constructed through the file to execu...