Total
2999 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2012-2226 | 1 Invisioncommunity | 1 Invision Power Board | 2024-11-21 | 9.8 Critical |
| Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary code by uploading a malicious file. | ||||
| CVE-2012-1592 | 1 Apache | 1 Struts | 2024-11-21 | 8.8 High |
| A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files. | ||||
| CVE-2011-4908 | 1 Tiny | 1 Tinybrowser | 2024-11-21 | 9.8 Critical |
| TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php. | ||||
| CVE-2011-4907 | 1 Joomla | 1 Joomla\! | 2024-11-21 | 5.3 Medium |
| Joomla! 1.5x through 1.5.12: Missing JEXEC Check | ||||
| CVE-2011-4906 | 1 Tiny | 1 Tinybrowser | 2024-11-21 | 9.8 Critical |
| Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution. | ||||
| CVE-2011-4183 | 1 Opensuse | 1 Open Build Service | 2024-11-21 | N/A |
| A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16. | ||||
| CVE-2011-2933 | 1 Websitebaker | 1 Websitebaker | 2024-11-21 | 7.2 High |
| An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .htaccess, .php4, .php5, and .phtl extensions. | ||||
| CVE-2011-1597 | 1 Openvas | 1 Openvas Manager | 2024-11-21 | 8.8 High |
| OpenVAS Manager v2.0.3 allows plugin remote code execution. | ||||
| CVE-2011-1134 | 1 S9y | 1 Serendipity | 2024-11-21 | 9.8 Critical |
| Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager. | ||||
| CVE-2011-10004 | 1 Reciply Project | 1 Reciply | 2024-11-21 | 6.3 Medium |
| A vulnerability was found in reciply Plugin up to 1.1.7 on WordPress. It has been rated as critical. This issue affects some unknown processing of the file uploadImage.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. Upgrading to version 1.1.8 is able to address this issue. The identifier of the patch is e3ff616dc08d3aadff9253f1085e13f677d0c676. It is recommended to upgrade the affected component. The identifier VDB-242189 was assigned to this vulnerability. | ||||
| CVE-2010-4661 | 5 Debian, Fedoraproject, Opensuse and 2 more | 5 Debian Linux, Fedora, Opensuse and 2 more | 2024-11-21 | 7.8 High |
| udisks before 1.0.3 allows a local user to load arbitrary Linux kernel modules. | ||||
| CVE-2010-3663 | 1 Typo3 | 1 Typo3 | 2024-11-21 | 8.8 High |
| TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend. | ||||
| CVE-2010-1433 | 1 Joomla | 1 Joomla\! | 2024-11-21 | 9.8 Critical |
| Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable. | ||||
| CVE-2024-52429 | 2 Anton Hoelstad, Antonhoelstad | 2 Wp Quick Setup, Wp Quick Setup | 2024-11-20 | 9.9 Critical |
| Unrestricted Upload of File with Dangerous Type vulnerability in Anton Hoelstad WP Quick Setup allows Upload a Web Shell to a Web Server.This issue affects WP Quick Setup: from n/a through 2.0. | ||||
| CVE-2024-11311 | 1 Trcore | 1 Dvc | 2024-11-20 | 9.8 Critical |
| The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells. | ||||
| CVE-2024-11312 | 1 Trcore | 1 Dvc | 2024-11-20 | 9.8 Critical |
| The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells. | ||||
| CVE-2024-11313 | 1 Trcore | 1 Dvc | 2024-11-20 | 9.8 Critical |
| The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells. | ||||
| CVE-2024-11314 | 1 Trcore | 1 Dvc | 2024-11-20 | 9.8 Critical |
| The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells. | ||||
| CVE-2024-11315 | 1 Trcore | 1 Dvc | 2024-11-20 | 9.8 Critical |
| The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells. | ||||
| CVE-2024-51743 | 1 Markusproject | 1 Markus | 2024-11-19 | 8.8 High |
| MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulnerability in the update/upload/create file methods in Controllers allows authenticated instructors to write arbitrary files to any location on the web server MarkUs is running on (depending on the permissions of the underlying filesystem). e.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application. MarkUs v2.4.8 has addressed this issue. No known workarounds are available at the application level aside from upgrading. | ||||