CVE-2018-3814

Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets-Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension...

Parallels Plesk Sitebuilder Multiple Vulnerabilities

Parallels Plesk Sitebuilder is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cromos - Download and Inject code into Google Chrome extensions

Cromos is a tool for downloading legitimate extensions of the Chrome Web Store and inject codes in the background of the application and more cromos create executable files to force installation via PowerShell for example, and also upload files to dropbox to host the malicious files. Download...

CVE-2017-14972

InFocus Mondopad 2.2.08 is vulnerable to authentication bypass when accessing uploaded files by entering Control-Alt-Delete, and then using Task Manager to reach a file...

CVE-2017-13982

A directory traversal vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows users to upload unrestricted files...

CVE-2017-1002024

Vulnerability in web application Kind Editor v4.1.12, kindeditor/php/uploadjson.php does not check authentication before allow users to upload files...

CVE-2017-1002016

Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files...

Authentication flaw

Vulnerability in web application Kind Editor v4.1.12, kindeditor/php/uploadjson.php does not check authentication before allow users to upload files...

Codextrous B2J Contact Extension Insecure File Access Vulnerability in Joomla!

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds, site search and other features . Codextrous B2J Contact aka b2jcontact is one of the plug-ins used to create a contact form . A security vulnerability exists i...

File Upload Vulnerability in Siemens Automation License Manager

Siemens Automation License Manager ALM is a software that centrally manages license keys for various Siemens software products. A file upload vulnerability exists in Siemens Automation License Manager. A remote attacker could use the vulnerability to send specially crafted packets to upload files...

jQuery Image Upload Vulnerability

jQuery is an American programmer John Resig developed a set of open source, cross-browser JavaScript library . There is a security vulnerability in jQuery. Since jQuery's jqueryuploadcrop fails to restrict the format of uploaded images, an attacker can exploit this vulnerability to upload specifi...

CVE-2016-6642

Vulnerability: CSRF in EMC ViPR SRM prior to 3.7.2 allows remote attackers to hijack administrator authentication for file-upload requests. Affected product: EMC ViPR SRM (storage resource management software). Root cause / vector: Cross-site request forgery. No exploit details are provided in th...

Design/Logic Flaw

The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files...

CVE-2015-8021

Incomplete blacklist vulnerability in the Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, Link Controller, and PSM 11.x before 11.2.1 HF11, 11.3.x, 11.4.0 before HF8, and 11.4.1 before HF6; BIG-IP AAM 11.4.0 before HF8 and 11.4.1 before HF6; BIG-IP AFM and PEM 11.3.x, 11.4.0...

Apache Jetspeed Directory Traversal Vulnerability

Jetspeed is based on Java and XML open source enterprise information portal implementation . Jetspeed can integrate a variety of data sources , through the XSL technology will be organized into a Jsp page data or Html page to the client ; Jetspeed also supports templates and content publishing...

Authentication flaw

QNAP Signage Station before 2.0.1 allows remote attackers to bypass authentication, and consequently upload files, via a spoofed HTTP request...

Manage Engine Application Manager 12.5 - Arbitrary Command Execution

!C:/Python27/python.exe -u Applications Manager 12.5 Arbitrary Command Execution Exploit Vendor: Zoho Corporation Pvt. Ltd. Product web page: https://www.manageengine.com Affected version: 12.5 Summary: ManageEngine Applications Manager is an application performance monitoring solution that...

Command injection

Cisco Emergency Responder 10.53.10000.9 allows remote attackers to upload files to arbitrary locations via a crafted parameter, aka Bug ID CSCuv25501...

CVE-2015-6407

Cisco Emergency Responder 10.53.10000.9 allows remote attackers to upload files to arbitrary locations via a crafted parameter, aka Bug ID CSCuv25501...

My.WiFi USB Drive 1.0 iOS - File Include Vulnerability

Exploit for iOS platform in category web applications Document Title: =============== My.WiFi USB Drive v1.0 iOS - File Include Vulnerability Product & Service Introduction: =============================== My WiFi USB drive. Files can be uploaded with any browser. Start the WiFi Drive web server...