CWE-434 · Unrestricted Upload of File with Dangerous Type (page 46)
Page 46 of 46 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-7695 | Critical | 9.8 | 2017-04-11 | Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any… |
CVE-2016-8973 | Medium | 4.3 | 2017-03-20 | IBM Rhapsody DM 4.0, 5.0 and 6.0 contains an undisclosed vulnerability that may allow an authenticated user to upload infected malicious files to the server. I… |
CVE-2015-3884 | High | 8.8 | 2017-03-17 | Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdP… |
CVE-2017-6104 | High | 7.5 | 2017-03-02 | Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0. |
CVE-2016-6104 | High | 7.2 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, wh… |
CVE-2016-8921 | High | 8.8 | 2017-02-01 | IBM FileNet WorkPlace XT could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable se… |
CVE-2016-6124 | High | 8.8 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary cod… |
CVE-2017-5520 | High | 8.8 | 2017-01-17 | The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enable… |
CVE-2016-7902 | High | 8.8 | 2017-01-04 | Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authenticated users with permissions to manage me… |
CVE-2016-9268 | High | 7.2 | 2016-11-10 | Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticate… |
CVE-2016-9187 | High | 8.8 | 2016-11-04 | Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbit… |
CVE-2016-9186 | High | 8.8 | 2016-11-04 | Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arb… |
CVE-2016-7452 | High | 7.5 | 2016-11-03 | The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder on the site via a cpi directory travers… |
CVE-2016-7095 | Critical | 9.8 | 2016-11-03 | Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one al… |
CVE-2015-1000013 | High | 7.8 | 2016-10-06 | Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1 |
CVE-2015-1000001 | Critical | 9.8 | 2016-10-06 | Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin |
CVE-2015-1000000 | Critical | 9.8 | 2016-10-06 | Remote file upload vulnerability in mailcwp v1.99 wordpress plugin |
CVE-2016-5050 | Critical | 9.8 | 2016-08-26 | Unrestricted file upload vulnerability in chat/sendfile.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary code by uploading and requesting a… |
CVE-2016-2914 | Medium | 5.4 | 2016-08-08 | Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated u… |
CVE-2016-3088 | Critical | 9.8 | 2016-06-01 | The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by a… |
CVE-2015-4524 | | 2015-07-04 | Unrestricted file upload vulnerability in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 befor… | |
CVE-2015-0702 | | 2015-04-21 | Unrestricted file upload vulnerability in the Custom Prompts upload implementation in Cisco Unified MeetingPlace 8.6(1.9) allows remote authenticated users to… | |
CVE-2006-6994 | | 2007-02-12 | Unrestricted file upload vulnerability in add.asp in OzzyWork Gallery, possibly 2.0 and earlier, allows remote attackers to upload and execute arbitrary ASP fi… | |
CVE-2006-5845 | | 2006-11-10 | Unrestricted file upload vulnerability in index.php in Speedywiki 2.0 allows remote authenticated users to upload and execute arbitrary PHP code by setting the… | |
CVE-2006-4558 | | 2006-09-06 | DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execute arbitrary PHP code by uploading file… | |
CVE-2006-4471 | | 2006-08-31 | The Admin Upload Image functionality in Joomla! before 1.0.11 allows remote authenticated users to upload files outside of the /images/stories/ directory via u… | |
CVE-2006-2428 | | 2006-05-17 | add.asp in DUware DUbanner 3.1 allows remote attackers to execute arbitrary code by uploading files with arbitrary extensions, such as ASP files, probably due… | |
CVE-2005-3288 | | 2005-10-23 | Mailsite Express allows remote attackers to upload and execute files with executable extensions such as ASP by attaching the file using the "compose page" feat… | |
CVE-2005-1868 | | 2005-06-09 | I-Man 0.9, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code by uploading a file attachment with a .php extension. | |
CVE-2005-1881 | | 2005-06-06 | upload.php in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict the file extension for uploaded image files, which allows remote attackers to upload arbi… | |
CVE-2005-0254 | Low | 3.7 | 2005-05-02 | BibORB 1.3.2, and possibly earlier versions, does not properly enforce a restriction for uploading only PDF and PS files, which allows remote attackers to uplo… |
CVE-2004-2262 | | 2004-12-31 | ImageManager in e107 before 0.617 does not properly check the types of uploaded files, which allows remote attackers to execute arbitrary code by uploading a P… | |
CVE-2002-1841 | | 2002-12-31 | The document management module in NOLA 1.1.1 and 1.1.2 does not restrict the types of files that are uploaded, which allows remote attackers to upload and exec… | |
CVE-2001-0901 | | 2001-11-19 | Hypermail allows remote attackers to execute arbitrary commands on a server supporting SSI via an attachment with a .shtml extension, which is archived on the… | |
CVE-2001-1099 | | 2001-09-07 | The default configuration of Norton AntiVirus for Microsoft Exchange 2000 2.x allows remote attackers to identify the recipient's INBOX file path by sending an… | |
CVE-2001-0340 | | 2001-07-21 | An interaction between the Outlook Web Access (OWA) service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious scrip… | |
CVE-1999-0036 | High | 8.4 | 1997-05-26 | IRIX login program with a nonzero LOCKOUT parameter allows creation or damage to files. |