Cross-site Scripting (XSS)

dompdf is vulnerable to cross-site scripting XSS attacks. The library does not filter user-supplied strings through uploaded pdf files, allowing a malicious user to inject and execute arbitrary web script...

Multiple ZOHO Products Path Traversal Vulnerability

ZOHO ManageEngine ServiceDesk Plus MSP and so on are the products of the American ZOHO company. ManageEngine ServiceDesk Plus MSP is a set of IT service management software based on the ITIL architecture ITSM; AssetExplorer is a set of IT asset management software; SupportCenter is a set of...

Apache OpenMeetings Denial of Service Vulnerability

Apache OpenMeetings is audio and video conferencing software. Apache OpenMeetings checks for security vulnerabilities in the content of uploaded files, allowing remote attackers to exploit the vulnerability to submit special multiple files for denial of service attacks...

Debian DSA-3897-1 : drupal7 - security update

Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2015-7943 Samuel Mortenson and Pere Orga discovered that the overlay module does not sufficiently validate URLs...

Files uploaded by anonymous users into a private file system can be accessed by other anonymous users

More info at https://www.drupal.org/SA-CORE-2017-003...

BigTree-CMS 4.2.x < 4.2.17 Multiple Vulnerabilities

Binary data 700143.prm...

Subsonic Cross-Site Scripting Vulnerability

Subsonic is a media streaming server that allows users to save music or collect videos on the server. Subsonic suffers from a cross-site scripting vulnerability. A remote attacker could use this vulnerability to persistently inject arbitrary web script or HTML via the name of an uploaded image...

Sql injection

DISPUTED BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and...

CVE-2017-9443

BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and...

PT-2017-18925 · Bigtree · Bigtree Cms

Name of the Vulnerable Software and Affected Versions: BigTree CMS versions 4.2.18 and earlier Description: The issue allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in...

CFME: default certificate used across all installs

CloudForms includes a default SSL/TLS certificate for the web server. This certificate is replaced at install time. However if an attacker were able to man-in-the-middle an administrator while installing the new certificate, the attacker could get a copy of the uploaded private key allowing for...

Unrestricted file upload

PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection...

Unspecified Vulnerability in Codextrous B2J Contact Extension for Joomla!

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds, site search and other features . Codextrous B2J Contact aka b2jcontact is one of the plug-ins used to create a contact form . A security vulnerability exists i...

CVE-2017-5214

The Codextrous B2J Contact aka b2jcontact extension before 2.1.13 for Joomla! allows prediction of a uniqid value based on knowledge of a time value. This makes it easier to read arbitrary uploaded files...

CVE-2017-8892

Cross-site scripting XSS vulnerability in OpenText Tempo Box 10.0.3 allows remote attackers to inject arbitrary web script or HTML persistently via the name of an uploaded image...

CVE-2017-8892

Cross-site scripting XSS vulnerability in OpenText Tempo Box 10.0.3 allows remote attackers to inject arbitrary web script or HTML persistently via the name of an uploaded image...

CVE-2016-8588

The hotfixupload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file...

Command injection

textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function. This may be a remote attack if a web application accepts names of arbitrary uploaded files...

CVE-2016-10320

textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function. This may be a remote attack if a web application accepts names of arbitrary uploaded files...

Fedora 25 : php-pear-PHP-CodeSniffer (2017-ca3f01bd37)

Version 2.8.1 - This release contains a fix for a security advisory related to the improper handling of shell commands - Uses of shellexec and exec were not escaping filenames and configuration settings in most cases - A properly crafted filename or configuration option would allow for arbitrary...