The vulnerability of the Upload function in the tpAdmin library allows a perpetrator to execute arbitrary code.

The vulnerability of the Upload function application\admin\controller\Upload.php in the tpAdmin library relates to the unlimited uploading of dangerous types of files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

PT-2023-15510

Name of the Vulnerable Software and Affected Versions Jedox version 2020.2.5 Description The issue is related to incorrect input validation for the default-storage-path in the settings page, allowing remote, authenticated users to specify the location as the Webroot directory. This can lead to th...

CVE-2022-45802 Apache StreamPark (incubating): Upload any file to any directory

Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high-risk files, and may upload them to any directory, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later...

PT-2023-14756 · Apache · Apache Streampark

Name of the Vulnerable Software and Affected Versions: Apache StreamPark versions prior to 2.0.0 Description: The issue allows any user to upload a jar as an application without mandatory verification of the uploaded file type. This enables users to upload high-risk files and potentially upload...

PT-2023-19494 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.106 Description: A critical issue was found, affecting the UpDateMemberModCache function of the file uploads/dede/config.php. This issue leads to unrestricted upload and can be exploited remotely. Recommendations: For...

Desdev DedeCMS 代码问题漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has features such as content publishing, content management, content editing and content retrieval. A code issue vulnerability exist...

PT-2023-19466 · Unknown · Zhong Bang Crmeb

Name of the Vulnerable Software and Affected Versions: Zhong Bang CRMEB version 4.6.0 Description: A critical issue affects the videoUpload function in the file SystemAttachmentServices.php, allowing unrestricted upload through manipulation of the filename argument. This can be initiated remotely...

Zhongbang CRMEB 代码问题漏洞

Zhongbang CRMEB is an open source e-commerce management system from Zhongbang Networks Zhongbang in Xi'an, China. A code issue vulnerability exists in Zhongbang CRMEB version 4.6.0, which stems from an incorrect operation of the parameter filename resulting in unrestricted file uploads...

PT-2023-23272 · Unknown · Startsharp +1

Name of the Vulnerable Software and Affected Versions: Serenity Serene versions prior to 6.7.0 StartSharp versions prior to 6.7.0 Description: A security issue was discovered where users can upload temporary files with certain file endings, such as .html or .htm, that contain a malicious payload...

Serenity Serene 跨站脚本漏洞

Serenity Serene is serenity open source is an ASP.NET Core / TypeScript application platform . A security vulnerability exists in Serenity Serene StartSharp versions prior to 6.7.0, which stems from the fact that when a user uploads a temporary file, certain specific file extensions are not...

Remote Code Execution (RCE)

froxlor/froxlor is vulnerable to Remote Code Execution RCE. Lack of proper checking for unrestricted file uploads with dangerous types allows an attacker to execute harmful code on the system through uploading crafted files with malicious content...

CVE-2023-30613

Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCMS prior to 12.2, there is no control over what kinds of files can be uploaded. Thus, a malicious actor may upload an .exe file or a file containing embedded...

CVE-2023-30613 Kiwi TCMS unrestricted file upload vulnerability

Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCMS prior to 12.2, there is no control over what kinds of files can be uploaded. Thus, a malicious actor may upload an .exe file or a file containing embedded...

Fedora 37 : mod_security (2023-09f0496e60)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-09f0496e60 advisory. - new version 2.9.7 - switch to PCRE2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 38 : mod_security (2023-bc61f7a145)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-bc61f7a145 advisory. - new version 2.9.7 - switch to PCRE2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Meinberg Funkuhren LTOS 代码问题漏洞

Meinberg Funkuhren LTOS is a tape data storage technology from Meinberg Funkuhren, Germany. A code issue vulnerability exists in Meinberg Funkuhren LTOS versions prior to V7.06.013, which stems from the file upload function of the LTOS web interface failing to properly validate input. A remote...

Kiwi TCMS 代码问题漏洞

Kiwi TCMS is a leading open source test management system for manual and automated testing from Kiwi TCMS Open Source. A code issue vulnerability exists in versions of Kiwi TCMS prior to 12.2 that stems from an inability to control what types of files can be uploaded. An attacker could exploit th...

Nokia NetAct 跨站脚本漏洞

Nokia NetAct is a network management system from the Finnish company Nokia. A security vulnerability exists in Nokia NetAct versions prior to 22 SP1037, which stems from the configuration tool's upload option not validating file contents. An attacker could exploit the vulnerability to perform...

Design/Logic Flaw

NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler, where an attacker with the appropriate level of authorization can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalation of privileges, information disclosure, and data tamperi...

HANSUNCMS 代码问题漏洞

HANSUNCMS is a website builder system of China HANSUN Technology HANSUN Company. HANSUNCMS 1.4.3 version of the code problematic vulnerability, the vulnerability stems from the file /ueditor/net/controller.ashx?action=catchimage there are problems, will lead to unrestricted uploads...