UBUNTU-CVE-2016-6188

Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service memory consumption via a large number of attempts to upload a large attachment, related to temporary files...

CVE-2016-8938

IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. This code could be executed on the UCD agent machines that host customer's production applications...

The vulnerability of the CODESYS Runtime Toolkit execution environment allows a perpetrator to execute arbitrary commands and load arbitrary files.

The vulnerability of the CODESYS Runtime Toolkit lies in the absence of requirements for authentication procedures in the default configuration. Exploiting this vulnerability allows a malicious actor to execute commands through the command line interface and upload arbitrary files...

DEBIAN-CVE-2017-5489

Cross-site request forgery CSRF vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving a Flash file upload...

UBUNTU-CVE-2017-5489

Cross-site request forgery CSRF vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving a Flash file upload...

File Upload Vulnerability in Jtbccms V1.0

Jtbccms is a website system that can expand and clone existing modules. A file upload vulnerability exists in version 1.0 of jtbccms. Due to the background file management office did not verify the uploaded files, resulting in the upload of arbitrary files, serious server privileges can be obtain...

CVE-2016-9836

The file scanning mechanism of JFilterInput::isFileSafe in Joomla! CMS before 3.6.5 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to upload and execute files with the .php6, .php7, .phtml, and .phpt extensions. Additionally,...

Security update for Mozilla Firefox (important)

Mozilla Firefox was updated to 49.0.2 to fix two security issues and some bugs. The following vulnerabilities were fixed: CVE-2016-5287: Crash in nsTArraybase bsc1006475 CVE-2016-5288: Web content can read cache entries bsc1006476 The following changes and fixes are included: Asynchronous renderi...

tomcat: non-persistent DoS attack by feeding data by aborting an upload

It was found that Tomcat would keep connections open after processing requests with a large enough request body. A remote attacker could potentially use this flaw to exhaust the pool of available connections and preventing further, legitimate connections to the Tomcat server to be made...

Webform - Less Critical - Access Bypass - SA-CONTRIB-2016-053

This module provides a user interface to create and configure forms called Webforms. When using forms with private file uploads, Webform wasn't explicitly denying access to files it managed which could allow access to be granted by other modules. The vulnerability is mitigated by the fact that...

File Upload Vulnerability in Fckeditor, a Teaching Management System of Zhengfang Software Co.

The Zhengfang Academic Affairs System is a multi-module integrated information management system for all departments of the college as well as users at all levels, including academic affairs public information maintenance, student management, faculty management, etc. The system is designed to be...

WDS CMS SQL Injection Vulnerability

WDS CMS is a website management system. WDS CMS suffers from a SQL injection vulnerability, which can be exploited by an attacker to gain access to the database contents, as well as to upload backdoor files in subsequent attacks...

Hippo CMS XML External Entity Information Disclosure Vulnerability

Hippo CMS is an open source information-centered content management system . It is a friendly interface , open system and can be integrated into existing systems to use . XXE XML External Entity is processed through SVG uploads in the image of the CMS and imported through XML in the CMS console...

WordPress Neosense Theme Upload Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Software Foundation.Neosense is a dynamic news theme for WordPress. An upload vulnerability exists in WordPress Neosense Theme. An attacker can exploit this vulnerability to upload arbitrary files to the...

The vulnerability of the CODESYS Runtime Toolkit execution environment allows a perpetrator to execute arbitrary commands and load arbitrary files.

The vulnerability of the CODESYS Runtime Toolkit lies in the absence of requirements for authentication procedures in the default configuration. Exploiting this vulnerability allows a malicious actor to execute commands through the command line interface and upload arbitrary files...

CVE-2016-6642

Cross-site request forgery CSRF vulnerability in EMC ViPR SRM before 3.7.2 allows remote attackers to hijack the authentication of administrators for requests that upload files...

w3school on the sample code for security vulnerabilities-vulnerability warning-the black bar safety net

This vulnerability principle itself is relatively simple, and very old. Here mainly want to explain, in w3school such a platform also there is such a code we write secure code or not enough attention. w3school examples for beginners plain and simple. A lot of people should look at this website to...

Nextcloud: Android - Possible to intercept broadcasts about uploaded files

Hi. There are the moments of sending unprotected broadcasts https://github.com/nextcloud/android/blob/master/src/com/owncloud/android/files/services/FileUploader.javaL1170 https://github.com/nextcloud/android/blob/master/src/com/owncloud/android/files/services/FileUploader.javaL1116...

CVE-2015-5719

CVE-2015-5719 affects Malware Information Sharing Platform (MISP) before 2.3.92. The issue is in app/Controller/TemplatesController.php where filenames under tmp/files/ are not properly restricted. CNVD-2016-07269 notes this allows a local attacker to perform a symbolic link attack to overwrite a...

Design/Logic Flaw

The Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, and Link Controller 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP AAM 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP AFM an...