CVE-2019-8933

In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory without being blocked by the Web Application Firewall, and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on...

The vulnerability of Juniper Networks’ Junos Space platform, related to the unlimited loading of malicious files, allows attackers to upload malware-infected files.

The vulnerability of the Juniper Networks Junos Space network resource management platform is related to the ability to load files of a malicious nature without limitation. Exploiting this vulnerability allows a remote attacker to load malicious files into the system...

Popular Torrent Uploader 'CracksNow' Caught Spreading Ransomware

It's not at all surprising that downloading movies and software from the torrent network could infect your computer with malware, but it's more heartbreaking when a popular, trusted file uploader goes rogue. Popular software cracks/keygens uploader "CracksNow," who had trusted status from many...

CVE-2013-5654

Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage...

Design/Logic Flaw

Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage...

CVE-2013-5654

Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage...

CVE-2013-5654

Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage...

CVE-2013-5654

The CVE-2013-5654 entry describes a vulnerability in YingZhi Python Programming Language v1.9 where an attacker can perform arbitrary anonymous uploads to the device’s storage. The available description states this is a vulnerability affecting YingZhi’s Python runtime, enabling uploads without au...

Several Popular Beauty Camera Apps Caught Stealing Users' Photos

Just because an app is available on Google Play Store doesn't mean that it is a legitimate app. Despite so many efforts by Google, some fake and malicious apps do sneak in and land millions of unaware users on the hunting ground of scammers and hackers. Cybersecurity firm Trend Micro uncovered at...

Discourse < 2.2.0.beta7 non-avatar Uploads Vulnerability

Discourse is prone to a vulnerability where users can pick non-avatar uploads. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

UBUNTU-CVE-2017-6922

In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not...

The vulnerability of the IIoT Monitor platform, related to the lack of restrictions on file uploads, allows attackers to upload and execute malicious files.

The vulnerability of the IIoT Monitor platform lies in the lack of restrictions on file uploads. Exploiting this vulnerability allows a remote attacker to upload and execute malicious files, which can be automatically processed within the product environment...

doorGets CMS 7.0 File Download

Exploit Title: doorGets CMS 7.0 - Arbitrary File Download Dork: N/A Date: 2019-01-16 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.doorgets.com/ Software Link: https://netix.dl.sourceforge.net/project/doorgets-cms/doorGets%20CMS%20V7/doorGetsCMSV7.0.zip Version: 7.0 Category: Webapps...

Fedora 29 : php-horde-Horde-Form (2019-8fe9d427f1)

HordeForm 2.0.19 - mjr SECURITY: Prevent RCE vulnerability due to potential directory traversal in Image uploads An independent security researcher has reported this vulnerability to SecuriTeam Secure Disclosure program. Note that Tenable Network Security has extracted the preceding description...

Fedora 28 : php-horde-Horde-Form (2019-fb2ce5f6d9)

HordeForm 2.0.19 - mjr SECURITY: Prevent RCE vulnerability due to potential directory traversal in Image uploads An independent security researcher has reported this vulnerability to SecuriTeam Secure Disclosure program. Note that Tenable Network Security has extracted the preceding description...

CVE-2019-0017

The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1...

Design/Logic Flaw

IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 153750...

Apache 2.4.x < 2.4.3 Multiple Vulnerabilities

According to its banner, the version of Apache 2.4.x running on the remote host is prior 2.4.3. It is, therefore, affected by the following vulnerabilities : - An input validation error exists related to 'modnegotiation', 'Multiviews' and untrusted uploads that can allow cross-site scripting...

Roxy Fileman 1.4.5 File Upload / Directory Traversal

====================================================================== Exploit Title:: Multiple Vulnerabilities Software: Roxy Fileman Version: 1.4.5 Vendor Homepage: http://www.roxyfileman.com/ Software Link: http://www.roxyfileman.com/download.php?f=1.4.5-php CVE number: CVE-2018-20525,...

Fedora 28 : php-symfony4 (2018-6edf04d9d6)

Version 4.0.15 2018-12-06 - security CVE-2018-19790 Security\Http detect bad redirect targets using backslashes @xabbuh - security CVE-2018-19789 Form Filter file uploads out of regular form types @nicolas-grekas Note that Tenable Network Security has extracted the preceding description block...