Design/Logic Flaw

Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage...

CVE-2013-5654

Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage...

CVE-2013-5654

Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage...

CVE-2013-5654

The CVE-2013-5654 entry describes a vulnerability in YingZhi Python Programming Language v1.9 where an attacker can perform arbitrary anonymous uploads to the device’s storage. The available description states this is a vulnerability affecting YingZhi’s Python runtime, enabling uploads without au...

Several Popular Beauty Camera Apps Caught Stealing Users' Photos

Just because an app is available on Google Play Store doesn't mean that it is a legitimate app. Despite so many efforts by Google, some fake and malicious apps do sneak in and land millions of unaware users on the hunting ground of scammers and hackers. Cybersecurity firm Trend Micro uncovered at...

Discourse < 2.2.0.beta7 non-avatar Uploads Vulnerability

Discourse is prone to a vulnerability where users can pick non-avatar uploads. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

UBUNTU-CVE-2017-6922

In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not...

The vulnerability of the IIoT Monitor platform, related to the lack of restrictions on file uploads, allows attackers to upload and execute malicious files.

The vulnerability of the IIoT Monitor platform lies in the lack of restrictions on file uploads. Exploiting this vulnerability allows a remote attacker to upload and execute malicious files, which can be automatically processed within the product environment...

doorGets CMS 7.0 File Download

Exploit Title: doorGets CMS 7.0 - Arbitrary File Download Dork: N/A Date: 2019-01-16 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.doorgets.com/ Software Link: https://netix.dl.sourceforge.net/project/doorgets-cms/doorGets%20CMS%20V7/doorGetsCMSV7.0.zip Version: 7.0 Category: Webapps...

Fedora 29 : php-horde-Horde-Form (2019-8fe9d427f1)

HordeForm 2.0.19 - mjr SECURITY: Prevent RCE vulnerability due to potential directory traversal in Image uploads An independent security researcher has reported this vulnerability to SecuriTeam Secure Disclosure program. Note that Tenable Network Security has extracted the preceding description...

Fedora 28 : php-horde-Horde-Form (2019-fb2ce5f6d9)

HordeForm 2.0.19 - mjr SECURITY: Prevent RCE vulnerability due to potential directory traversal in Image uploads An independent security researcher has reported this vulnerability to SecuriTeam Secure Disclosure program. Note that Tenable Network Security has extracted the preceding description...

CVE-2019-0017

The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1...

Design/Logic Flaw

IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 153750...

Apache 2.4.x < 2.4.3 Multiple Vulnerabilities

According to its banner, the version of Apache 2.4.x running on the remote host is prior 2.4.3. It is, therefore, affected by the following vulnerabilities : - An input validation error exists related to 'modnegotiation', 'Multiviews' and untrusted uploads that can allow cross-site scripting...

Roxy Fileman 1.4.5 File Upload / Directory Traversal

====================================================================== Exploit Title:: Multiple Vulnerabilities Software: Roxy Fileman Version: 1.4.5 Vendor Homepage: http://www.roxyfileman.com/ Software Link: http://www.roxyfileman.com/download.php?f=1.4.5-php CVE number: CVE-2018-20525,...

Fedora 28 : php-symfony4 (2018-6edf04d9d6)

Version 4.0.15 2018-12-06 - security CVE-2018-19790 Security\Http detect bad redirect targets using backslashes @xabbuh - security CVE-2018-19789 Form Filter file uploads out of regular form types @nicolas-grekas Note that Tenable Network Security has extracted the preceding description block...

Fedora 29 : php-symfony (2018-b38a4dd0c7)

Version 2.8.49 2018-12-06 - security CVE-2018-19790 Security\Http detect bad redirect targets using backslashes @xabbuh - security CVE-2018-19789 Form Filter file uploads out of regular form types @nicolas-grekas Note that Tenable Network Security has extracted the preceding description block...

CVE-2018-6334

CVE-2018-6334 affects HHVM, where multipart-file uploads cause variables to be registered in the global scope. Affects all supported HHVM versions prior to the patch: 3.25.1, 3.24.5, 3.21.9 and below. Reported CVSS: 9.8 (CRITICAL, NETWORK, LOW complexity, no auth). Root cause: improper global reg...

CVE-2018-6334

Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly before being used this can lead to unexpected behavior. This affects all supported versions of HHVM prior to the patch 3.25.1, 3.24.5, and 3.21.9 and below...

CVE-2018-6334

Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly before being used this can lead to unexpected behavior. This affects all supported versions of HHVM prior to the patch 3.25.1, 3.24.5, and 3.21.9 and below...