8625 matches found
Design/Logic Flaw
An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads...
CVE-2018-17055
CVE-2018-17055 affects Progress Sitefinity CMS, versions 4.0 through 11.0. The issue is an arbitrary file upload vulnerability related to image uploads. The provided documents do not specify the exact attack vector, exploit details, or affected components beyond the image-upload context, nor do t...
CVE-2018-17055
An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads...
Monstra CMS Arbitrary File Deletion Vulnerability
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A security vulnerability exists in the admin/index.php file in Monstra CMS version 3.0.4. An attacker can...
GHSA-VQCQ-MRMW-MCMG Rubyzip gem contains a Directory Traversal vulnerability in zip file component
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file...
CVE-2018-16432
BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...
CVE-2018-16432
BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...
Sql injection
BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...
PT-2018-13566 · Bluecms · Bluecms
Name of the Vulnerable Software and Affected Versions: BlueCMS version 1.6 Description: The issue allows SQL Injection via the user name parameter to the "uploads/user.php?act=index login" endpoint. Recommendations: For BlueCMS version 1.6, avoid using the user name parameter in the affected...
CVE-2018-16432
BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...
Umbraco Code Execution Vulnerability
Umbraco is a Danish company Umbraco a set of use ASP.Net to build , Mysql for data storage content management system CMS. The system supports customized templates , manage users , define permissions on the content and so on. A code execution vulnerability exists in Umbraco versions prior to 7.2.0...
Code execution vulnerability in niubicms
niubicms is by the Nanjing Niukun Network Technology Co., Ltd. independent research and development of the novel website source code, news website source code, for PHP open source system. niubicms code execution vulnerabilities exist. Attackers can take advantage of the vulnerability to upload...
Design/Logic Flaw
An exploitable firmware update vulnerability exists in Insteon Hub running firmware version 1013. The HTTP server allows for uploading arbitrary MPFS binaries that could be modified to enable access to hidden resources which allow for uploading unsigned firmware images to the device. To trigger...
File Upload Vulnerability in Servcorp Highway Project Management Information System
Servcorp Highway Project Management Information System is an engineering project management platform developed for project participants. A file upload vulnerability exists in the Servcorp Expressway Project Management Information System. The vulnerability stems from the failure to strictly restri...
DEBIAN-CVE-2018-14028
In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then...
CVE-2018-14028
In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then...
UBUNTU-CVE-2018-14028
In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then...
CVE-2018-14028
In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then...
UBUNTU-CVE-2018-10931
It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon...