Koji Path Traversal Vulnerability

Koji is an RPM build system. A path traversal vulnerability in Koji 1.18.0 and earlier versions can be exploited by an attacker to upload a file to an arbitrary location...

CVE-2007-6685

Unspecified vulnerability in the Publish XP module Menalto Gallery before 2.2.4 allows attackers to create albums and upload files via unknown vectors...

F5 Networks BIG-IP : F5 tmsh vulnerability (K40378764)

"Authenticated users with the ability to upload files via scp, for example can escalate their privileges to allow root shell access from within the TMOS Shell tmsh interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp . CVE-2019-6642 Impact...

Pydio Cells Elevation of Privilege Vulnerability

Pydio Cells is a transition application for managing files on a Pydio Cells 1.2.X server. An elevation of privilege vulnerability exists in versions of Pydio Cells prior to 1.5.0, which stems from Pydio Cells failing to neutralize the... /element, which can be exploited by an attacker with very l...

Privilege escalation

Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an unprivileged directory, leading to Privilege escalation...

Design/Logic Flaw

Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used to upload files...

CVE-2019-4013

IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges. This results in code execution on underlying system with root privileges. IBM X-Force ID: 155887...

MailEnable Path Traversal Vulnerability

MailEnable is a suite of POP3 and SMTP mail servers from MailEnable Australia. A directory traversal vulnerability exists in MailEnable versions prior to 8.60, which stems from the program incorrectly handling '/... /' and '/... /' sequences. An attacker could exploit this vulnerability to read...

CVE-2018-13332

Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL parameter...

Directory traversal

Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL parameter...

CVE-2018-19424

ClipperCMS 1.3.3 allows remote authenticated administrators to upload .htaccess files...

CVE-2018-16051

An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Orphaned Upload Files Exposure...

CVE-2018-16051

Affected product: GitLab Community and Enterprise Edition prior to 11.0.6, 11.1.x prior to 11.1.5, and 11.2.x prior to 11.2.2. Issue: Orphaned Upload Files Exposure. Root cause: exposure of orphaned uploaded files. Impact: potential exposure of uploaded file data. Remediation: upgrade to fixed re...

CVE-2018-16051

Removed by vendor...

CVE-2018-10931

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon...

CVE-2018-10931

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon...

Remote code execution

A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attacker authenticated as an administrator to upload files to an arbitrary path on the server. In certain circumstances this could result in remote code execution...

The vulnerability in the scripts beatsUploader.php, photoUploader.php, and editAccount.php of the ClipBucket video content management system allows a hacker to upload malicious files to the server.

The vulnerability of the ClipBucket video content management system’s scripts beatUploader.php, photoUploader.php, and editAccount.php can be exploited. Exploiting this vulnerability allows a malicious actor to upload malicious files to the server using parameters like name for beatUploader.php a...

CVE-2016-7443

Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location."...

Oracle Database Attacking Tool: ODAT

ODAT Oracle Database Attacking Tool is an open source penetration testing tool that tests the security of Oracle Databases remotely . Usage examples of ODAT: You have an Oracle database listening remotely and want to find valid SIDs and credentials in order to connect to the database You have a...