CWE-434 · Unrestricted Upload of File with Dangerous Type (page 38)
Page 38 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-0920 | High | 8.8 | 2020-04-15 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microso… |
CVE-2020-10507 | Critical | 9.8 | 2020-04-15 | The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Unrestricted file upload (RCE) , that would allow at… |
CVE-2020-11722 | Critical | 9.8 | 2020-04-12 | Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc fi… |
CVE-2020-10621 | Critical | 9.8 | 2020-04-09 | Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2). |
CVE-2020-11598 | Critical | 9.8 | 2020-04-06 | An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. Upload.ashx allows remote attackers to execute arbitrary code by uploading and executing an… |
CVE-2020-11544 | High | 7.2 | 2020-04-06 | An issue was discovered in Project Worlds Official Car Rental System 1. It allows the admin user to run commands on the server with their account because the u… |
CVE-2020-8639 | High | 8.8 | 2020-04-03 | An unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote attackers to execute arbitrary code by uploading a file with a… |
CVE-2020-11451 | High | 7.2 | 2020-04-02 | The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files with arbitrary exten… |
CVE-2020-6008 | Critical | 9.8 | 2020-03-31 | LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution |
CVE-2020-10964 | Critical | 9.8 | 2020-03-25 | Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. This file may… |
CVE-2020-10963 | High | 7.2 | 2020-03-25 | FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload… |
CVE-2020-10934 | High | 7.2 | 2020-03-24 | Acyba AcyMailing before 6.9.2 mishandles file uploads by admins. |
CVE-2020-8866 | Medium | 6.5 | 2020-03-23 | This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is req… |
CVE-2020-8511 | High | 7.2 | 2020-03-23 | In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Repository component, a different issue th… |
CVE-2020-7935 | High | 7.2 | 2020-03-23 | Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type issue in the File… |
CVE-2020-10806 | Critical | 9.8 | 2020-03-22 | eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before… |
CVE-2020-10682 | High | 7.8 | 2020-03-20 | The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php… |
CVE-2019-16066 | High | 8.8 | 2020-03-19 | An unrestricted file upload vulnerability exists in user and system file upload functions in NETSAS Enigma NMS 65.0.0 and prior. This allows an attacker to upl… |
CVE-2020-9423 | Critical | 9.8 | 2020-03-18 | LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc prov… |
CVE-2019-11074 | High | 7.2 | 2020-03-17 | A Write to Arbitrary Location in Disk vulnerability exists in PRTG Network Monitor 19.1.49 and below that allows attackers to place files in arbitrary location… |
CVE-2020-9472 | Medium | 6.5 | 2020-03-16 | Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality. |
CVE-2020-9471 | High | 8.8 | 2020-03-16 | Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality. |
CVE-2020-5844 | High | 7.2 | 2020-03-16 | index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and exe… |
CVE-2020-10557 | High | 8.8 | 2020-03-16 | An issue was discovered in AContent through 1.4. It allows the user to run commands on the server with a low-privileged account. The upload section in the file… |
CVE-2020-10562 | High | 7.2 | 2020-03-13 | An issue was discovered in DEVOME GRR before 3.4.1c. admin_edit_room.php mishandles file uploads. |
CVE-2020-10386 | High | 7.2 | 2020-03-12 | admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by uploading a .php file in the… |
CVE-2016-6918 | Critical | 9.8 | 2020-03-09 | Lexmark Markvision Enterprise (MVE) before 2.4.1 allows remote attackers to execute arbitrary commands by uploading files. ( |
CVE-2015-7341 | High | 8.8 | 2020-03-09 | JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension. |
CVE-2015-7339 | High | 8.8 | 2020-03-09 | JCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an image file to the /com_jce/editor/libraries/classes/browser.p… |
CVE-2020-5256 | High | 7.9 | 2020-03-09 | BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code… |
CVE-2020-10225 | Critical | 9.8 | 2020-03-08 | An unauthenticated file upload vulnerability has been identified in admin/gallery.php in PHPGurukul Job Portal 1.0. The vulnerability could be exploited by an… |
CVE-2020-10224 | Critical | 9.8 | 2020-03-08 | An unauthenticated file upload vulnerability has been identified in admin_add.php in PHPGurukul Online Book Store 1.0. The vulnerability could be exploited by… |
CVE-2020-9380 | Critical | 9.8 | 2020-03-05 | IPTV Smarters WEB TV PLAYER through 2020-02-22 allows attackers to execute OS commands by uploading a script. |
CVE-2018-19798 | High | 8.8 | 2020-03-02 | Fleetco Fleet Maintenance Management (FMM) 1.2 and earlier allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the accidents_a… |
CVE-2020-8500 | High | 7.2 | 2020-03-02 | In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. NOTE: The vendor report… |
CVE-2018-17058 | High | 8.8 | 2020-03-02 | An issue was discovered in JABA XPress Online Shop through 2018-09-14. It contains an arbitrary file upload vulnerability in the picture-upload feature of Prod… |
CVE-2016-11020 | Critical | 9.8 | 2020-02-25 | Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution. |
CVE-2020-5188 | Medium | 6.5 | 2020-02-24 | DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions. |
CVE-2020-9320 | Medium | 5.5 | 2020-02-20 | Avira AV Engine before 8.3.54.138 allows virus-detection bypass via a crafted ISO archive. This affects versions before 8.3.54.138 of Antivirus for Endpoint, A… |
CVE-2015-0258 | High | 8.8 | 2020-02-17 | Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to… |
CVE-2020-6975 | Medium | 4.9 | 2020-02-12 | Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2. Successful exploitation of this vulnerability coul… |
CVE-2011-4908 | Critical | 9.8 | 2020-02-12 | TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php. |
CVE-2011-4906 | Critical | 9.8 | 2020-02-12 | Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution. |
CVE-2013-3684 | Critical | 9.8 | 2020-02-11 | NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload |
CVE-2013-2057 | Critical | 9.8 | 2020-02-11 | YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability |
CVE-2013-0803 | Critical | 9.8 | 2020-02-11 | A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arbitrary code. |
CVE-2019-20451 | Critical | 9.8 | 2020-02-10 | The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /RE… |
CVE-2014-8739 | Critical | 9.8 | 2020-02-08 | Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Cre… |
CVE-2013-3591 | High | 8.8 | 2020-02-07 | vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability |
CVE-2015-6000 | High | 8.8 | 2020-02-06 | Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtig… |
CVE-2011-1597 | High | 8.8 | 2020-02-06 | OpenVAS Manager v2.0.3 allows plugin remote code execution. |
CVE-2020-6754 | Critical | 9.8 | 2020-02-05 | dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOM… |
CVE-2014-2025 | Critical | 9.8 | 2020-01-31 | Unrestricted file upload vulnerability in an unspecified third party tool in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6… |
CVE-2020-8440 | Critical | 9.8 | 2020-01-31 | controllers/page_apply.php in Simplejobscript.com SJS through 1.66 is prone to unauthenticated Remote Code Execution by uploading a PHP script as a resume. |
CVE-2013-2748 | Critical | 9.8 | 2020-01-28 | Belkin Wemo Switch before WeMo_US_2.00.2176.PVT could allow remote attackers to upload arbitrary files onto the system. |
CVE-2020-7998 | High | 8.8 | 2020-01-28 | An arbitrary file upload vulnerability has been discovered in the Super File Explorer app 1.0.1 for iOS. The vulnerability is located in the developer path tha… |
CVE-2013-7390 | Critical | 9.8 | 2020-01-27 | Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to exec… |
CVE-2020-6965 | Critical | 9.9 | 2020-01-24 | In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE… |
CVE-2012-6649 | Critical | 9.8 | 2020-01-23 | WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload. |
CVE-2019-16514 | High | 7.2 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users… |
CVE-2013-6358 | High | 8.8 | 2020-01-23 | PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory. |
CVE-2012-5190 | Critical | 9.8 | 2020-01-21 | Prizm Content Connect 5.1 has an Arbitrary File Upload Vulnerability |
CVE-2020-7246 | High | 8.8 | 2020-01-21 | A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionalit… |
CVE-2019-20385 | High | 8.8 | 2020-01-21 | The CSV upload feature in /supervisor/procesa_carga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/* content type. The… |
CVE-2020-2730 | Medium | 5.4 | 2020-01-15 | Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: File Upload). Suppo… |
CVE-2011-4907 | Medium | 5.3 | 2020-01-15 | Joomla! 1.5x through 1.5.12: Missing JEXEC Check |
CVE-2011-2933 | High | 7.2 | 2020-01-14 | An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .hta… |
CVE-2020-5509 | High | 7.2 | 2020-01-14 | PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image. |
CVE-2019-20183 | High | 7.2 | 2020-01-09 | uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side… |
CVE-2012-2950 | High | 8.1 | 2020-01-09 | Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote attackers to execute local PHP code and ob… |
CVE-2012-2226 | Critical | 9.8 | 2020-01-09 | Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary… |
CVE-2014-3448 | Critical | 9.8 | 2020-01-09 | BSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated file upload |
CVE-2020-5846 | High | 8.8 | 2020-01-06 | An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/obm7/file/upload" request with the base64-… |
CVE-2015-5951 | Critical | 9.9 | 2020-01-06 | A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web r… |
CVE-2015-4553 | High | 8.8 | 2020-01-06 | A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell. |
CVE-2020-5514 | Critical | 9.1 | 2020-01-06 | Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI. |
CVE-2014-8516 | Critical | 9.8 | 2020-01-03 | Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an executab… |
CVE-2014-8337 | Critical | 9.8 | 2020-01-03 | Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attackers to execute arbi… |
CVE-2019-16790 | Medium | 6.5 | 2019-12-30 | In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted. |
CVE-2019-20048 | High | 7.2 | 2019-12-27 | An issue was discovered on Alcatel-Lucent OmniVista 8770 devices before 4.1.2. An authenticated remote attacker, with elevated privileges in the Web Directory… |
CVE-2013-4796 | High | 8.8 | 2019-12-27 | ReviewBoard 1.6.17 allows code execution by attaching PHP scripts to review request |
CVE-2019-19925 | High | 7.5 | 2019-12-24 | zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive. |
CVE-2019-8293 | Critical | 9.8 | 2019-12-23 | Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution. |
CVE-2019-19634 | Critical | 9.8 | 2019-12-17 | class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the… |
CVE-2019-19745 | High | 8.8 | 2019-12-17 | Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the… |
CVE-2019-18320 | High | 7.5 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18313 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could gain remot… |
CVE-2019-18288 | High | 8.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with valid authentication at the RMI i… |
CVE-2019-15936 | Critical | 9.8 | 2019-12-12 | Intesync Solismed 3.3sp allows Insecure File Upload. |
CVE-2019-4612 | High | 8.8 | 2019-12-09 | IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious execut… |
CVE-2019-19684 | High | 8.8 | 2019-12-09 | nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentica… |
CVE-2012-1592 | High | 8.8 | 2019-12-05 | A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files. |
CVE-2019-19595 | Critical | 9.8 | 2019-12-05 | reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execut… |
CVE-2019-19594 | Critical | 9.8 | 2019-12-05 | reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers to execute arbitrary… |
CVE-2019-11216 | Medium | 6.5 | 2019-12-04 | BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to downl… |
CVE-2019-19576 | Critical | 9.8 | 2019-12-04 | class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the… |
CVE-2019-4130 | High | 8.8 | 2019-12-03 | IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the v… |
CVE-2019-19020 | High | 7.2 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an att… |
CVE-2019-19493 | Medium | 5.4 | 2019-12-02 | Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS. |
CVE-2019-19468 | High | 7.8 | 2019-11-30 | Free Photo Viewer 1.3 allows remote attackers to execute arbitrary code via a crafted BMP and/or TIFF file that triggers a malformed SEH, as demonstrated by a… |