Unrestricted File Upload

verot/class.upload.php allows unrestricted file upload. The lack of file extension validation on file uploads allow a remote attacker to upload malicious files ending with .phar. When browsing to the uploaded file, the server executes the code in the file in the context of the server...

CVE-2018-7217

In Bravo Tejari Procurement Portal, uploaded files are not properly validated by the application either on the client or the server side. An attacker can take advantage of this vulnerability and upload malicious executable files to compromise the application, as demonstrated by an...

Authentication flaw

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within uploadsavedo.jsp. The issue results from the lack of proper validation of a...

Advantech WebAccess Dashboard Viewer uploadImageCommon Arbitrary File Upload

This module exploits an arbitrary file upload vulnerability found in Advantech WebAccess 8.0. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw...

rubygem-paperclip -- validation bypass vulnerability

Jon Yurek reports: Thanks to MORI Shingo of DeNA Co., Ltd. for reporting this. There is an issue where if an HTML file is uploaded with a .html extension, but the content type is listed as being image/jpeg, this will bypass a validation checking for images. But it will also pass the spoof check,...

HP ArcSight Logger < 6.0P1 Multiple Vulnerabilities

According to its self-reported version number, the version of HP ArcSight Logger installed on the remote host is prior to 6.0P1. It is, therefore, affected by the following vulnerabilities : - An XXE injection vulnerability exists due to the improper verification of sources. An authenticated,...

php云人才系统 小漏洞一步步getshell（后台）

简要描述： php云人才系统 小漏洞一步步getshell，这里包含了php与mysql交互时候的特性（也算一个漏洞），还有phpyun自身图片的验证机制问题，等等，步骤比较艰辛，本来想在这里搞一个csrf呢，找了半天没有找到，到时找到一大堆xss，这里就不利用xss了，且看分析 详细说明： 首先我们做一个小测试： 对于mysql存储来说，建站者都会给每一个字段设置长度，然后当我们插入进去的数据长度超过了设置的长度，那么mysql是不会报错，然而会自然截断存储，这个就给我们编写程序的人留下了隐患。 利用场景分析...

Oracle Linux 5 : php (ELSA-2012-1045)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1045 advisory. - fix issue in CVE-2012-0057 patch - fix memory handling in CVE-2012-0789 patch - add security fixes for CVE-2012-0057, CVE-2011-4153, CVE-2012-0789,...

anwsion问答系统存在任意文件上传重大漏洞

简要描述： 上传只做了js验证貌似 详细说明： 本人只在topic话题下上传了，貌似头像上传那里也存在该问题（没测试） 点击话题图像，就可以编辑上传图像了。 使用火狐的TAMPER DATA插件，并打开开始截获。 选择一个2bb.jpg（内涵php一句话的正常图片即可 该文件目录内还有一个2bb.php（留作备用 在tamaper data内修改数据，把2bb.JPG改成2bb.php即可 就可以看到上传上去的php图片小马了，但是这个是经过处理的 只要把url后面的100X100参数或者50x50参数去除，就可以得到一个没有经过处理的PHP小马了。 漏洞证明： 官方已经拿到shell了...

[SECURITY] [DSA 2465-1] php5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2465-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst May 09, 2012 http://www.debian.org/security/faq -...

Fedora 17 : maniadrive-1.2-38.fc17 / php-5.4.1-1.fc17 (2012-6869)

Upstream Security Enhancements : - Fixed bug 54374 Insufficient validating of upload name leading to corrupted $FILES indices. CVE-2012-1172. - Add openbasedir checks to readlinewritehistory and readlinereadhistory. Upstream announce: http://www.php.net/archive/2012.phpid2012-04-26-1 Note that...

OpenCart Multiple Vulnerabilities

This host is running OpenCart and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbopencartmultvuln.nasl 7577 2017-10-26 10:41:56Z cfischer $ OpenCart Multiple Vulnerabilities Authors: Madhuri D Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net...

CVE-2008-0569

The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified vectors...

CVE-2008-0569

The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified vectors...

CVE-2008-0569

The CVE-2008-0569 entry concerns Drupal’s Comment Upload module. Affected: Comment Upload 4.7.x (before 4.7.x-0.1) and 5.x (before 5.x-0.1). Root cause: the module does not properly use functions in the upload module, allowing bypass of upload validation. Impact: remote attackers may upload arbit...

CVE-2008-0569: Undefined Security Weakness

The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified vectors...

ADVISORY: ASPDOTNETSTOREFRONT Improper Upload Validation

ASPDOTNETSTOREFRONT Improper Upload Validation Release Date: June 9, 2004 Severity: HIGH Vendor: AspDotNetStorefront.com A Division of Discovery Productions, Inc. Software: Tested on AspDotNetStorefront 3.3 Previous versions may also be affected. Remote: Remotely executed from any web browser...