PT-2019-10358

Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 70.0.23 Description: The issue allows local privilege escalation via the WHM Legacy Language File Upload interface. Recommendations: For versions prior to 70.0.23, update to version 70.0.23 or later to resolve the iss...

CVE-2018-18830

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

PT-2018-14679

Name of the Vulnerable Software and Affected Versions MCMS version 4.6.5 Description An issue was discovered in the FileAction.java file, where the upload interface does not verify the user login status, allowing files to be uploaded without setting a cookie. This can be exploited by uploading JS...

WordPress: Buddypress 2.9.1 - Exceeding the maximum upload size - XSS leading to potential RCE.

Description This report is very similar to https://hackerone.com/bugs?subject=user&reportid=203515 so I will not go into too much details. When uploading a avatar or profile background image thats larger than allowd, the error containing the filename will be output unsanitized leading to XSS...

Cisco 8800 Series IP Phone Directory Traversal Vulnerability

A vulnerability in the license upload interface of Cisco 8800 Series IP Phones could allow an authenticated, remote attacker to delete arbitrary files from the filesystem. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by uploading invalid...

CVE-2013-5541

Cross-site scripting XSS vulnerability in the file-upload interface in Cisco Identity Services Engine ISE allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename, aka Bug ID CSCui67495...

PT-2013-5622

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Description A cross-site scripting XSS issue exists in the file-upload interface, allowing remote authenticated users to inject arbitrary web script or HTML via a crafted...

CVE-2013-5541: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the file-upload interface in Cisco Identity Services Engine ISE allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename, aka Bug ID CSCui67495...