CVE-2018-9999

In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the default LOCALUPLOADSDIR storage backend...

CVE-2018-9999

In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the default LOCALUPLOADSDIR storage backend...

Cross site scripting

In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the default LOCALUPLOADSDIR storage backend...

CVE-2018-5341

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts...

CVE-2018-9999

CVE-2018-9999 affects Zulip Server prior to 1.7.2. The issue is an XSS vulnerability triggered by user uploads when using the default LOCAL_UPLOADS_DIR storage backend. The connected sources confirm this is a cross-site scripting flaw in versions

CVE-2018-9999

In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the default LOCALUPLOADSDIR storage backend...

SAP Disclosure Management File Upload Vulnerability

SAP Disclosure Management is an automated financial disclosure management system from SAP. The system provides a collaborative financial disclosure process across teams, geographies, systems and data sources. A security vulnerability exists in SAP Disclosure Management version 10.1, which stems...

Monstra CMS File Deletion Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A security vulnerability exists in Monstra CMS version 3.0.4. A remote attacker can send a message to...

CVE-2018-9038

Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&deletedir=./&path=uploads/ request...

CVE-2018-9038

Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&deletedir=./&path=uploads/ request...

CVE-2018-9038

Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&deletedir=./&path=uploads/ request...

CVE-2018-9038

Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&deletedir=./&path=uploads/ request...

Cscms v4.1.8 Command Execution Vulnerability in Backend

Cscms is a diversified content management system developed using PHP5+MYSQL as the technical basis. Cscms v4.1.8 has a command execution vulnerability in the backend. An attacker can execute php commands by uploading malicious compressed files...

CVE-2018-8719

An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/ files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information...

CVE-2018-8719

An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/ files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information...

Cross site request forgery (csrf)

DISPUTED An issue was discovered on AXIS M1033-W IP camera Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server...

CVE-2018-9157

An issue was discovered on AXIS M1033-W IP camera Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server modinclude...

Frog CMS Arbitrary File Upload Vulnerability

Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. A security vulnerability exists in Frog CMS version 0.9.5 due to a lack of extension detection in the...

CVE-2017-15715

In Apache httpd 2.4.0 to 2.4.29, the expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the...

Directory override delete vulnerability in Monstra CMS backend filesmanager.admin.php file

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A directory override vulnerability exists in the filesmanager.admin.php file in the backend of Monstra CMS. A...