CWE-434 · Unrestricted Upload of File with Dangerous Type (page 42)
Page 42 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-10648 | Critical | 9.8 | 2018-05-23 | There are Unauthenticated File Upload Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. |
CVE-2017-2617 | High | 7.6 | 2018-05-22 | hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a crafted file which cou… |
CVE-2018-11322 | High | 7.5 | 2018-05-22 | An issue was discovered in Joomla! Core before 3.8.8. Depending on the server configuration, PHAR files might be handled as executable PHP scripts by the webse… |
CVE-2018-11345 | High | 8.8 | 2018-05-22 | An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the POST parameter filen… |
CVE-2018-11340 | High | 7.2 | 2018-05-22 | An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a specified filename… |
CVE-2018-11331 | Critical | 9.8 | 2018-05-21 | An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applic… |
CVE-2018-4921 | Medium | 6.1 | 2018-05-19 | Adobe Connect versions 9.7 and earlier have an exploitable unrestricted SWF file upload vulnerability. Successful exploitation could lead to information disclo… |
CVE-2018-10760 | High | 8.8 | 2018-05-16 | Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated users to execute arbitrary PHP code by u… |
CVE-2018-7505 | Critical | 9.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-11098 | High | 7.2 | 2018-05-15 | An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upload URI, a similar issue to CVE-2014-491… |
CVE-2018-11091 | Critical | 9.9 | 2018-05-14 | An issue was discovered in MyBiz MyProcureNet 5.0.0. A malicious file can be uploaded to the webserver by an attacker. It is possible for an attacker to upload… |
CVE-2018-0587 | Medium | 4.3 | 2018-05-14 | Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary ima… |
CVE-2018-0568 | High | 8.8 | 2018-05-14 | Unrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows remote authenticated users to execute arbitrary PHP code via u… |
CVE-2018-10942 | Critical | 9.8 | 2018-05-10 | modules/attributewizardpro/file_upload.php in the Attribute Wizard addon 1.6.9 for PrestaShop 1.4.0.1 through 1.6.1.18 allows remote attackers to execute arbit… |
CVE-2018-2420 | Medium | 6.5 | 2018-05-09 | SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to upload any file (including script files) without proper file format… |
CVE-2018-10795 | High | 8.8 | 2018-05-07 | Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically proces… |
CVE-2018-0258 | Critical | 9.8 | 2018-05-02 | A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directo… |
CVE-2018-10577 | High | 8.8 | 2018-05-02 | An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. File uplo… |
CVE-2016-10036 | Critical | 9.8 | 2018-05-01 | Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbitrary servlet applic… |
CVE-2018-10521 | Low | 2.7 | 2018-04-27 | In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS… |
CVE-2018-10469 | Critical | 9.8 | 2018-04-27 | b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI. |
CVE-2018-10375 | Critical | 9.8 | 2018-04-25 | A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbit… |
CVE-2018-10173 | High | 8.8 | 2018-04-20 | Digital Guardian Management Console 7.1.2.0015 allows authenticated remote code execution because of Arbitrary File Upload functionality. |
CVE-2018-9153 | High | 7.2 | 2018-04-16 | The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the app_id parameter to zb_users/plugin/AppCentre/plug… |
CVE-2016-10258 | Medium | 6.8 | 2018-04-11 | Unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A malicious appliance administrator can u… |
CVE-2018-9037 | High | 8.8 | 2018-04-10 | Monstra CMS 3.0.4 allows remote code execution via an upload_file request for a .zip file, which is automatically extracted and may contain .php files. |
CVE-2018-2404 | Medium | 4.3 | 2018-04-10 | SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation. |
CVE-2018-9157 | High | 7.5 | 2018-04-01 | An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can up… |
CVE-2018-9156 | High | 7.5 | 2018-04-01 | An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can uplo… |
CVE-2015-9259 | Critical | 9.8 | 2018-03-31 | In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does… |
CVE-2018-8944 | Critical | 9.8 | 2018-03-22 | PHPOK 4.8.338 has an arbitrary file upload vulnerability. |
CVE-2017-16772 | High | 8.8 | 2018-03-22 | Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authentic… |
CVE-2014-4912 | Critical | 9.8 | 2018-03-22 | An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation. |
CVE-2018-8766 | Critical | 9.8 | 2018-03-18 | joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/admin_vod.php?action=… |
CVE-2017-16251 | High | 8.8 | 2018-03-13 | A vulnerability in the conferencing component of Mitel ST 14.2, release GA28 and earlier, could allow an authenticated user to upload a malicious script to the… |
CVE-2018-1000094 | High | 7.2 | 2018-03-13 | CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access t… |
CVE-2018-7562 | High | 7.5 | 2018-03-12 | A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable file that… |
CVE-2014-2592 | Critical | 9.8 | 2018-03-09 | Unrestricted file upload vulnerability in Aruba Web Management portal allows remote attackers to execute arbitrary code by uploading a file with an executable… |
CVE-2018-1215 | High | 8.8 | 2018-03-08 | An arbitrary file upload vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VA… |
CVE-2016-7443 | Critical | 9.8 | 2018-03-07 | Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location." |
CVE-2018-7665 | Critical | 9.8 | 2018-03-05 | An issue was discovered in ClipBucket before 4.0.0 Release 4902. A malicious file can be uploaded via the name parameter to actions/beats_uploader.php or actio… |
CVE-2018-7567 | High | 7.2 | 2018-03-04 | In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blin… |
CVE-2017-9279 | Low | 2.0 | 2018-03-02 | NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the User Application Admini… |
CVE-2017-7429 | High | 8.8 | 2018-03-02 | The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated at… |
CVE-2015-0796 | Medium | 6.3 | 2018-03-02 | In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlin… |
CVE-2017-6931 | Medium | 6.5 | 2018-03-01 | In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the… |
CVE-2018-7316 | Critical | 9.8 | 2018-02-22 | Arbitrary File Upload exists in the Proclaim 9.1.1 component for Joomla! via a mediafileform action. |
CVE-2018-7217 | High | 8.8 | 2018-02-18 | In Bravo Tejari Procurement Portal, uploaded files are not properly validated by the application either on the client or the server side. An attacker can take… |
CVE-2016-8515 | High | 8.8 | 2018-02-15 | A remote malicious file upload vulnerability in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6. |
CVE-2017-1499 | High | 8.8 | 2018-02-14 | IBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to include arbitrary files, which could allow the attacker to execute arbitrary code on t… |
CVE-2017-9970 | High | 7.2 | 2018-02-12 | A remote code execution vulnerability exists in Schneider Electric's StruxureOn Gateway versions 1.1.3 and prior. Uploading a zip which contains carefully craf… |
CVE-2018-6860 | High | 8.8 | 2018-02-12 | Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a profile picture. |
CVE-2018-6580 | Critical | 9.8 | 2018-02-02 | Arbitrary file upload exists in the Jimtawl 2.1.6 and 2.2.5 component for Joomla! via a view=upload&task=upload&pop=true&tmpl=component request. |
CVE-2017-17976 | Critical | 9.8 | 2018-01-26 | In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution. |
CVE-2017-14521 | High | 8.8 | 2018-01-26 | In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload. |
CVE-2018-1342 | Critical | 9.8 | 2018-01-26 | A Vulnerability exists on Admin Console where an attacker can upload files to the Admin Console server, and potentially execute them. This impacts NetIQ Access… |
CVE-2018-5997 | Critical | 9.8 | 2018-01-25 | An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056. Due to an unrestricted upload feature and a path traversal vulnerability, it is possi… |
CVE-2018-4834 | Critical | 9.8 | 2018-01-24 | A vulnerability has been identified in Desigo PXC00-E.D V4.10 (All versions < V4.10.111), Desigo PXC00-E.D V5.00 (All versions < V5.0.171), Desigo PXC00-E.D V5… |
CVE-2018-5749 | Critical | 9.8 | 2018-01-23 | install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database… |
CVE-2017-18048 | High | 8.8 | 2018-01-23 | Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocke… |
CVE-2017-16594 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Alth… |
CVE-2018-5724 | Critical | 9.8 | 2018-01-16 | MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Download and Upload, as demonstrated by restore.cgi. |
CVE-2017-16736 | High | 7.5 | 2018-01-12 | An Unrestricted Upload Of File With Dangerous Type issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows a remote attacker to upl… |
CVE-2014-4972 | Critical | 9.8 | 2018-01-08 | Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by upl… |
CVE-2017-15549 | High | 8.8 | 2018-01-05 | An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Dat… |
CVE-2018-3814 | High | 8.8 | 2018-01-01 | Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because t… |
CVE-2017-17987 | High | 7.2 | 2017-12-30 | PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php. |
CVE-2017-17874 | High | 8.8 | 2017-12-27 | Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php… |
CVE-2017-16949 | Critical | 9.8 | 2017-12-19 | An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to… |
CVE-2017-15876 | High | 7.2 | 2017-12-19 | Unrestricted File Upload vulnerability in GPWeb 8.4.61 allows remote authenticated users to upload any type of file, including a PHP shell. |
CVE-2017-17727 | High | 8.8 | 2017-12-18 | DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to mem… |
CVE-2017-17593 | High | 7.5 | 2017-12-13 | Simple Chatting System 1.0 allows Arbitrary File Upload via view/my_profile.php, which places files under uploads/. |
CVE-2017-13156 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-642118… |
CVE-2017-12332 | Medium | 4.4 | 2017-11-30 | A vulnerability in Cisco NX-OS System Software patch installation could allow an authenticated, local attacker to write a file to arbitrary locations. The vuln… |
CVE-2017-15673 | High | 7.2 | 2017-11-28 | The files function in the administration section in CS-Cart 4.6.2 and earlier allows attackers to execute arbitrary PHP code via vectors involving a custom pag… |
CVE-2017-15054 | High | 7.5 | 2017-11-27 | An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Comm… |
CVE-2017-16941 | High | 8.8 | 2017-11-25 | October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a… |
CVE-2017-2737 | High | 8.8 | 2017-11-22 | VCM5010 with software versions earlier before V100R002C50SPC100 has an arbitrary file upload vulnerability. The software does not validate the files that uploa… |
CVE-2017-2699 | High | 7.8 | 2017-11-22 | The Huawei Themes APP in versions earlier than PLK-UL00C17B385, versions earlier than CRR-L09C432B380, versions earlier than LYO-L21C577B128 has a privilege el… |
CVE-2017-8862 | Critical | 9.8 | 2017-11-22 | The webupgrade function on the Cohu 3960HD does not verify the firmware upgrade files or process, allowing an attacker to upload a specially crafted postinstal… |
CVE-2017-1000238 | High | 8.8 | 2017-11-17 | InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is pos… |
CVE-2017-1000194 | Critical | 9.8 | 2017-11-17 | October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applicat… |
CVE-2017-16524 | High | 8.8 | 2017-11-06 | Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_upload.php' allows remote authenticated… |
CVE-2017-10940 | High | 8.8 | 2017-10-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to agentsshar@1.0.0-release-… |
CVE-2017-15990 | Critical | 9.8 | 2017-10-31 | Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/. |
CVE-2017-15962 | Critical | 9.8 | 2017-10-29 | iStock Management System 1.0 allows Arbitrary File Upload via user/profile. |
CVE-2017-15957 | High | 8.8 | 2017-10-29 | my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file. |
CVE-2011-4334 | High | 8.8 | 2017-10-23 | edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated users to upload arbitrary PHP files via a P… |
CVE-2017-15580 | Critical | 9.8 | 2017-10-23 | osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents an… |
CVE-2014-2664 | High | 8.8 | 2017-10-17 | Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM befo… |
CVE-2015-2780 | Critical | 9.8 | 2017-10-16 | Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable exte… |
CVE-2017-1000119 | High | 7.2 | 2017-10-05 | October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the… |
CVE-2017-12617 | High | 8.1 | 2017-10-04 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the re… |
CVE-2017-6090 | High | 8.8 | 2017-10-03 | Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by… |
CVE-2017-14958 | High | 7.2 | 2017-10-02 | lib.php in PivotX 2.3.11 does not properly block uploads of dangerous file types by admin users, which allows remote PHP code execution via an upload of a .php… |
CVE-2017-13982 | High | 8.8 | 2017-09-30 | A directory traversal vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows users to… |
CVE-2017-14841 | Medium | 6.5 | 2017-09-28 | Mojoomla Annual Maintenance Contract (AMC) Management System allows Arbitrary File Upload in profilesetting image handling. |
CVE-2017-14840 | High | 8.8 | 2017-09-28 | TeamWork TicketPlus allows Arbitrary File Upload in updateProfile. |
CVE-2017-14839 | High | 8.8 | 2017-09-28 | TeamWork Photo Fusion allows Arbitrary File Upload in changeAvatar and changeCover. |
CVE-2017-14838 | High | 8.8 | 2017-09-28 | TeamWork Job Links allows Arbitrary File Upload in profileChange and coverChange. |