Search
Total
1387 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-14570 | 1 Niushop | 1 B2b2c Multi-business | 2018-09-20 | 6.5 MEDIUM | 8.8 HIGH |
| A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a .php file to the web server via a profile avatar field, by using an image Content-Type (e.g., image/jpeg) with a modified filename and file content. This results in arbitrary code execution by requesting that .php file. | |||||
| CVE-2018-14334 | 1 Joyplus-cms Project | 1 Joyplus-cms | 2018-09-17 | 7.5 HIGH | 9.8 CRITICAL |
| manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766. | |||||
| CVE-2018-10577 | 1 Watchguard | 8 Ap100, Ap100 Firmware, Ap102 and 5 more | 2018-09-16 | 9.0 HIGH | 8.8 HIGH |
| An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. File upload functionality allows any users authenticated on the web interface to upload files containing code to the web root, allowing these files to be executed as root. | |||||
| CVE-2018-14441 | 1 Ssh Companywebsite Project | 1 Ssh Companywebsite | 2018-09-14 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. admin/admin/fileUploadAction_fileUpload.action allows arbitrary file upload, as demonstrated by a .jsp file with the image/jpeg content type. | |||||
| CVE-2018-13981 | 1 Zeta-producer | 1 Zeta Producer Desktop Cms | 2018-09-12 | 7.5 HIGH | 9.8 CRITICAL |
| The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated remote code execution due to a default component that permits arbitrary upload of PHP files, because the formmailer widget blocks .php files but not .php5 or .phtml files. This is related to /assets/php/formmailer/SendEmail.php and /assets/php/formmailer/functions.php. | |||||
| CVE-2018-1000619 | 1 Ovidentia | 1 Ovidentia | 2018-09-11 | 6.5 MEDIUM | 8.8 HIGH |
| Ovidentia version 8.4.3 and earlier contains a Unsanitized User Input vulnerability in utilit.php, bab_getAddonFilePathfromTg that can result in Authenticated Remote Code Execution. This attack appear to be exploitable via The attacker must have permission to upload addons. | |||||
| CVE-2017-16251 | 1 Mitel | 1 St14.2 | 2018-09-07 | 9.0 HIGH | 8.8 HIGH |
| A vulnerability in the conferencing component of Mitel ST 14.2, release GA28 and earlier, could allow an authenticated user to upload a malicious script to the Personal Library by a crafted POST request. Successful exploit could allow an attacker to execute arbitrary code within the context of the application. | |||||
| CVE-2018-12528 | 1 Intex | 2 N150, N150 Firmware | 2018-09-05 | 7.5 HIGH | 8.1 HIGH |
| An issue was discovered on Intex N150 devices. The backup/restore option does not check the file extension uploaded for importing a configuration files backup, which can lead to corrupting the router firmware settings or even the uploading of malicious files. In order to exploit the vulnerability, an attacker can upload any malicious file and force reboot the router with it. | |||||
| CVE-2018-11638 | 1 Dialogic | 1 Powermedia Xms | 2018-09-05 | 9.0 HIGH | 7.2 HIGH |
| Unrestricted Upload of a File with a Dangerous Type in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote authenticated users to upload malicious code to the web root to gain code execution. | |||||
| CVE-2018-13024 | 1 Metinfo | 1 Metinfo | 2018-08-24 | 6.5 MEDIUM | 7.2 HIGH |
| Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action. | |||||
| CVE-2018-0571 | 1 Basercms | 1 Basercms | 2018-08-21 | 4.0 MEDIUM | 4.3 MEDIUM |
| baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files. | |||||
| CVE-2018-13021 | 1 Hongcms Project | 1 Hongcms | 2018-08-21 | 9.0 HIGH | 7.2 HIGH |
| An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI. | |||||
| CVE-2018-12914 | 1 Publiccms | 1 Publiccms | 2018-08-20 | 7.5 HIGH | 9.8 CRITICAL |
| A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation, the attacker can execute arbitrary code by visiting a .jsp URI. | |||||
| CVE-2018-11221 | 1 Artica | 1 Pandora Fms | 2018-08-14 | 7.5 HIGH | 9.8 CRITICAL |
| Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manager.ajax in the update system. | |||||
| CVE-2018-12519 | 1 Codenx | 1 Shopnx | 2018-08-13 | 4.0 MEDIUM | 8.8 HIGH |
| An issue was discovered in ShopNx through 2017-11-17. The vulnerability allows a remote attacker to upload any malicious file to a Node.js application. An attacker can upload a malicious HTML file that contains a JavaScript payload to steal a user's credentials. | |||||
| CVE-2018-12491 | 1 Phpok | 1 Phpok | 2018-07-27 | 7.5 HIGH | 9.8 CRITICAL |
| PHPOK 4.9.032 has an arbitrary file upload vulnerability in the import_f function in framework/admin/modulec_control.php, as demonstrated by uploading a .php file within a .php.zip archive, a similar issue to CVE-2018-8944. | |||||
| CVE-2018-12045 | 1 Dedecms | 1 Dedecms | 2018-07-27 | 7.5 HIGH | 9.8 CRITICAL |
| DedeCMS through V5.7SP2 allows arbitrary file upload in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file. | |||||
| CVE-2018-11736 | 1 Pluck-cms | 1 Pluck | 2018-07-23 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file. | |||||
| CVE-2018-12051 | 1 Schools Alert Management Script Project | 1 Schools Alert Management Script | 2018-07-17 | 7.5 HIGH | 9.8 CRITICAL |
| Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $_FILE in /webmasterst/general.php, as demonstrated by a .php file with the image/jpeg content type. | |||||
| CVE-2018-11196 | 1 Mahara | 1 Mahara | 2018-07-03 | 5.0 MEDIUM | 7.5 HIGH |
| Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 can be used as medium to transmit viruses by placing infected files into a Leap2A archive and uploading that to Mahara. In contrast to other ZIP files that are uploaded, ClamAV (when activated) does not check Leap2A archives for viruses, allowing malicious files to be available for download. While files cannot be executed on Mahara itself, Mahara can be used to transfer such files to user computers. | |||||
| CVE-2018-11494 | 1 Opencart | 1 Opencart | 2018-06-29 | 6.0 MEDIUM | 8.0 HIGH |
| The "program extension upload" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move, xml, remove) that allows attackers to execute arbitrary code if the remove step is skipped, because the attacker can discover a secret temporary directory name (containing 10 random digits) via a directory traversal attack involving language_info['code']. | |||||
| CVE-2018-11523 | 1 Nuuo | 2 Nvrmini 2, Nvrmini 2 Firmware | 2018-06-29 | 7.5 HIGH | 9.8 CRITICAL |
| upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files. | |||||
| CVE-2018-6411 | 1 Appnitro | 1 Machform | 2018-06-29 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Appnitro MachForm before 4.2.3. When the form is set to filter a blacklist, it automatically adds dangerous extensions to the filters. If the filter is set to a whitelist, the dangerous extensions can be bypassed through ap_form_elements SQL Injection. | |||||
| CVE-2018-11514 | 1 Naukri Clone Script Project | 1 Naukri Clone Script | 2018-06-28 | 6.5 MEDIUM | 8.8 HIGH |
| PHP Scripts Mall Naukri Clone Script through 3.0.3 allows Unrestricted Upload of a File with a Dangerous Type in edit_resume_det.php, as demonstrated by changing .docx to .php. | |||||
| CVE-2018-10648 | 1 Citrix | 1 Xenmobile Server | 2018-06-25 | 7.5 HIGH | 9.8 CRITICAL |
| There are Unauthenticated File Upload Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. | |||||
| CVE-2018-11322 | 1 Joomla | 1 Joomla\! | 2018-06-22 | 6.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Joomla! Core before 3.8.8. Depending on the server configuration, PHAR files might be handled as executable PHP scripts by the webserver. | |||||
| CVE-2018-11331 | 1 Pluck-cms | 1 Pluck | 2018-06-22 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess. | |||||
| CVE-2018-0568 | 1 Sitebridge | 1 Joruri Gw | 2018-06-19 | 6.5 MEDIUM | 8.8 HIGH |
| Unrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows remote authenticated users to execute arbitrary PHP code via unspecified vectors. | |||||
| CVE-2018-11098 | 1 Frog Cms Project | 1 Frog Cms | 2018-06-19 | 6.5 MEDIUM | 7.2 HIGH |
| An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upload URI, a similar issue to CVE-2014-4912. | |||||
| CVE-2018-10760 | 1 Projectpier | 1 Projectpier | 2018-06-19 | 6.5 MEDIUM | 8.8 HIGH |
| Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the tmp directory under the document root. | |||||
| CVE-2018-10942 | 2 Attribute Wizard Project, Prestashop | 2 Attribute Wizard, Prestashop | 2018-06-13 | 7.5 HIGH | 9.8 CRITICAL |
| modules/attributewizardpro/file_upload.php in the Attribute Wizard addon 1.6.9 for PrestaShop 1.4.0.1 through 1.6.1.18 allows remote attackers to execute arbitrary code by uploading a .phtml file. | |||||
| CVE-2016-10036 | 1 Jfrog | 1 Artifactory | 2018-06-13 | 7.5 HIGH | 9.8 CRITICAL |
| Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbitrary servlet application and execute arbitrary code by uploading a war file or (2) possibly write to arbitrary files and cause a denial of service by uploading an HTML file. | |||||
| CVE-2018-10795 | 1 Liferay | 1 Liferay Portal | 2018-06-13 | 6.5 MEDIUM | 8.8 HIGH |
| ** DISPUTED ** Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment via a browser/liferay/browser.html?Type= or html/js/editor/fckeditor/editor/filemanager/browser/liferay/browser.html URI. NOTE: the vendor disputes this issue because file upload is an expected feature, subject to Role Based Access Control checks where only authenticated users with proper permissions can upload files. | |||||
| CVE-2018-10375 | 1 Dedecms | 1 Dedecms | 2018-06-13 | 7.5 HIGH | 9.8 CRITICAL |
| A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archives_do.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename ends in .php and contains PHP code. | |||||
| CVE-2018-10469 | 1 B3log | 1 Symphony | 2018-06-04 | 7.5 HIGH | 9.8 CRITICAL |
| b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI. | |||||
| CVE-2018-10521 | 1 Cmsmadesimple | 1 Cms Made Simple | 2018-05-24 | 4.0 MEDIUM | 2.7 LOW |
| In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory. | |||||
| CVE-2018-9153 | 1 Zblogcn | 1 Z-blogphp | 2018-05-23 | 6.5 MEDIUM | 7.2 HIGH |
| The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the app_id parameter to zb_users/plugin/AppCentre/plugin_edit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directly by an administrator, or through CSRF. | |||||
| CVE-2018-10173 | 1 Digitalguardian | 1 Management Console | 2018-05-22 | 9.0 HIGH | 8.8 HIGH |
| Digital Guardian Management Console 7.1.2.0015 allows authenticated remote code execution because of Arbitrary File Upload functionality. | |||||
| CVE-2018-9037 | 1 Monstra | 1 Monstra | 2018-05-17 | 6.5 MEDIUM | 8.8 HIGH |
| Monstra CMS 3.0.4 allows remote code execution via an upload_file request for a .zip file, which is automatically extracted and may contain .php files. | |||||
| CVE-2018-9156 | 1 Axis | 2 P1354, P1354 Firmware | 2018-05-15 | 7.6 HIGH | 7.5 HIGH |
| ** DISPUTED ** An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality. | |||||
| CVE-2018-9157 | 1 Axis | 2 M1033-w, M1033-w Firmware | 2018-05-15 | 7.6 HIGH | 7.5 HIGH |
| ** DISPUTED ** An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality. | |||||
| CVE-2017-9101 | 1 Playsms | 1 Playsms | 2018-05-11 | 7.5 HIGH | 9.8 CRITICAL |
| import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file. | |||||
| CVE-2015-9259 | 1 Docker | 1 Notary | 2018-05-01 | 7.5 HIGH | 9.8 CRITICAL |
| In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise, an attacker can produce update files referring to an old root.json file. | |||||
| CVE-2018-8944 | 1 Phpok | 1 Phpok | 2018-04-20 | 7.5 HIGH | 9.8 CRITICAL |
| PHPOK 4.8.338 has an arbitrary file upload vulnerability. | |||||
| CVE-2014-4912 | 1 Frog Cms Project | 1 Frog Cms | 2018-04-18 | 7.5 HIGH | 9.8 CRITICAL |
| An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation. | |||||
| CVE-2018-8766 | 1 Joyplus-cms Project | 1 Joyplus-cms | 2018-04-13 | 7.5 HIGH | 9.8 CRITICAL |
| joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/admin_vod.php?action=add. | |||||
| CVE-2018-7562 | 1 Glpi-project | 1 Glpi | 2018-04-11 | 6.0 MEDIUM | 7.5 HIGH |
| A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable file that will be disallowed. The application allows an authenticated user to upload a file when he/she creates a new ticket via front/fileupload.php. This feature is protected using different types of security features like the check on the file's extension. However, the application uploads and creates a file, though this file is not allowed, and then deletes the file in the uploadFiles method in inc/glpiuploaderhandler.class.php. | |||||
| CVE-2016-1713 | 1 Vtiger | 1 Vtiger Crm | 2018-04-02 | 8.5 HIGH | 7.3 HIGH |
| Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in test/logo/. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6000. | |||||
| CVE-2018-7567 | 1 Otrs | 1 Otrs | 2018-03-29 | 9.0 HIGH | 7.2 HIGH |
| ** DISPUTED ** In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code Execution vulnerability by loading a crafted opm file with an embedded CodeInstall element to execute a command on the server during package installation. NOTE: the vendor disputes this issue stating "the behaviour is as designed and needed for different packages to be installed", "there is a security warning if the package is not verified by OTRS Group", and "there is the possibility and responsibility of an admin to check packages before installation which is possible as they are not binary." | |||||
| CVE-2018-1215 | 1 Dell | 4 Emc Solutions Enabler Virtual Appliance, Emc Unisphere For Vmax Virtual Appliance, Emc Vasa Virtual Appliance and 1 more | 2018-03-29 | 9.0 HIGH | 8.8 HIGH |
| An arbitrary file upload vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement): Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.21, Dell EMC VASA Virtual Appliance versions prior to 8.4.0.514, and Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and earlier). A remote authenticated malicious user may potentially upload arbitrary maliciously crafted files in any location on the web server. By chaining this vulnerability with CVE-2018-1216, the attacker may use the default account to exploit this vulnerability. | |||||