PT-2023-28318 · Elitecms · Elitecms

Name of the Vulnerable Software and Affected Versions: EliteCMS version 1.01 Description: A file upload vulnerability allows a remote attacker to execute arbitrary code via the manage uploads.php component. Recommendations: For EliteCMS version 1.01, consider disabling the file upload functionali...

PT-2023-28838 · Telstra · Telstra Smart Modem Gen 2

Name of the Vulnerable Software and Affected Versions: Telstra Smart Modem Gen 2 Arcadyan LH1000 versions prior to 0.18.15r Description: The issue allows unauthenticated attackers to upload firmware images and configuration backups, potentially leading to code execution as root. This could enable...

CVE-2023-42331

A file upload vulnerability in EliteCMS v1.01 allows a remote attacker to execute arbitrary code via the manageuploads.php component...

PT-2023-8997 · Jenkins +1 · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.423 and earlier, LTS 2.414.1 and earlier Description: The issue is related to the processing of file uploads using the Stapler web framework, which creates temporary files in the default system temporary directory with the...

USN-6382-1 memcached vulnerability

It was discovered that Memcached incorrectly handled certain multi-packet uploads in UDP. An attacker could possibly use this issue to cause a denial of service...

PT-2023-7871 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI affected versions not specified Description: The issue is related to the Custom Includes module of Nagios XI, which is vulnerable to unrestricted file upload of dangerous types. This could allow a remote attacker to execute arbitrar...

Ubuntu: Security Advisory (USN-6370-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6370-1: ModSecurity vulnerabilities

It was discovered that ModSecurity incorrectly handled certain nested JSON objects. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. CVE-2021-42717 It was discovered that ModSecurity incorrect...

netty: world readable temporary file containing sensitive data

CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled...

CVE-2023-40784

DedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/modulemake.php...

CVE-2023-40731

A vulnerability has been identified in QMS Automotive All versions V12.39. The affected application allows users to upload arbitrary file types. This could allow an attacker to upload malicious files, that could potentially lead to code tampering...

CVE-2023-40731

A vulnerability has been identified in QMS Automotive All versions V12.39. The affected application allows users to upload arbitrary file types. This could allow an attacker to upload malicious files, that could potentially lead to code tampering...

CVE-2023-42472 Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)

Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface - version 420, allows a report creator to upload files from local system into the report over the network. When uploading the image file, an authenticated attacker could...

CVE-2023-40784

DedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/modulemake.php...

PT-2023-5302 · Unknown · Modulys Gp

Name of the Vulnerable Software and Affected Versions: MODULYS GP MOD3GP-SY-120K affected versions not specified Description: The issue exists due to a lack of protection for the web page structure, allowing a remote attacker to perform cross-site scripting XSS attacks. This could enable an...

The vulnerability of the upload_post_image() function in the Forminator plugin of the WordPress content management system allows a hacker to bypass security restrictions and execute arbitrary code.

The vulnerability of the uploadpostimage function in the Forminator plugin of the WordPress content management system involves unlimited uploading of dangerous types of files. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions and execute arbitrary code...

Infinity Market Classified Ads Script 1.6.2 Cross Site Scripting

==================================================================================================================================== | Title : Infinity Market Classified Ads Script 1.6.2 xss via file uploads Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro | | Vendor...

CVE-2023-3375

Unrestricted Upload of File with Dangerous Type vulnerability in Unisign Bookreen allows OS Command Injection. This issue affects Bookreen: before 3.0.0...

PT-2023-24472

Name of the Vulnerable Software and Affected Versions Bookreen versions prior to 3.0.0 Description The issue affects Unisign Bookreen, allowing OS Command Injection due to an Unrestricted Upload of File with Dangerous Type vulnerability. Recommendations For versions prior to 3.0.0, update to...

tomcat: Fix for CVE-2023-24998 was incomplete

A vulnerability has been identified in Apache Tomcat due to an incomplete fix for CVE-2023-24998, which aims to limit the uploaded request parts that can be bypassed in a request. This issue may allow an attacker to use a malicious upload or series of uploads to cause a crash triggering a denial ...