CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- nextcloud contactsA missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file...4.3 Medium
- mods-for-hesk mods for heskAn issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A privileged user can achieve...8.8 High
- expressionengineExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a ...8.8 High
- kordil edms project edmsdocuments_add.php in Kordil EDMS through 2.2.60rc3 allows Remote Command Execution because .php...8.8 High
- concretecms concrete cmsUnrestricted Uploads in Concrete55.3 Medium
- rockwellautomation factorytalk linx, rslinx classic +1 moreFactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected...7.5 High
- ibm spectrum protect plusIBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an...7.1 High
- naviwebs navigatecmsThe install_from_hash functionality in Navigate CMS 2.9 does not consider the .phtml extension...9.8 Critical
- vikisolutions veraThe Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on...7.2 High
- pandorafms pandora fmsArtica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via...7.2 High
- pandorafms pandora fmsArtica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via...7.2 High
- microsoft windows, windows 10 version 1903 for 32-bit systems, windows 10 version 1903 for arm64-based systems +19 more +21 moreAn elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer...8.8 High
- codedropz drag and drop multiple file upload - contact form 7The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows...9.8 Critical
- foxitsoftware phantompdfAn issue was discovered in Foxit PhantomPDF before 8.3.6. It has COM object mishandling when...6.5 Medium
- foxitsoftware phantompdfAn issue was discovered in Foxit PhantomPDF before 8.3.6. It allows arbitrary application...9.8 Critical
- synacor zimbra collaboration suiteZimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an...8.0 High
- mappresspro mappressThe mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly...8.8 High
- rubyonrails rails, debian linux, rails https://github.com/rails/rails +2 moreCircumvention of file size limits in ActiveStorage7.5 High
- dext5A Remote code execution vulnerability exists in DEXT5Upload in DEXT5 through 2.7.1402870. An...9.8 Critical
- monstraMonstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via...8.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1709 +28 more +30 moreWindows Background Intelligent Transfer Service Elevation of Privilege Vulnerability8.5 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint foundation 2013 service pack 1 +3 more +5 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint foundation 2013 service pack 1 +3 more +5 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.8 High
- pango virtual private network software development kitAn issue was discovered in AnchorFree VPN SDK before 1.3.3.218. The VPN SDK service takes certain...9.8 Critical
- microweberMicroweber allows Unrestricted File Upload7.8 High
- sourcefabric newscoopBecause of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7...7.8 High
- rconfigrConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file...8.8 High
- gwtupload project gwtuploadAn issue was discovered in Manolo GWTUpload 1.0.3. server/UploadServlet.java (the servlet for...7.5 High
- elementor page builderAn issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in...9.9 Critical
- six apart ltd. movable typeMovable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type...8.8 High
- pi-holeThe Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary...8.8 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +9 more +11 moreOm BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for...7.1 High
- opmantek open-auditAn issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload.8.8 High
- gigamon gigavueAn issue was discovered in Gigamon GigaVUE 5.5.01.11. The upload functionality allows an...6.2 Medium
- rukovoditelIn Rukovoditel V2.5.2, attackers can upload an arbitrary file to the server just changing the the...9.8 Critical
- mappresspro mappressThe mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly...8.8 High
- elementor page builderAn issue was discovered in Elementor 2.7.4. Arbitrary file upload is possible in the Elementor...9.9 Critical
- alanaktion phprojectRCE via file upload in Phproject9.9 Critical
- sysaid on-premiseSysAid On-Premise 20.1.11, by default, allows the AJP protocol port, which is vulnerable to a...9.8 Critical
- rukovoditelIn Rukovoditel 2.5.2, attackers can upload arbitrary file to the server by just changing the...9.8 Critical
- qdpmIn qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add...9.8 Critical
- silverstripeSilverStripe Folders migrated from 3.x may be unsafe to upload to7.5 High
- microsoft sharepoint enterprise server, sharepoint server +1 moreA remote code execution vulnerability exists in Microsoft SharePoint when the software fails to...8.8 High
- microsoft sharepoint enterprise server, sharepoint foundation, sharepoint server +2 moreA remote code execution vulnerability exists in Microsoft SharePoint when the software fails to...8.8 High
- microsoft sharepoint enterprise server, sharepoint foundation, sharepoint server +2 moreA remote code execution vulnerability exists in Microsoft SharePoint when the software fails to...8.8 High
- microsoft business productivity servers, sharepoint enterprise server, sharepoint foundation +1 more +3 moreA remote code execution vulnerability exists in Microsoft SharePoint when the software fails to...8.8 High
- microsoft sharepoint enterprise server, sharepoint foundation, sharepoint server +2 moreA remote code execution vulnerability exists in Microsoft SharePoint when the software fails to...8.8 High
- microsoft sharepoint enterprise server, sharepoint foundation, sharepoint server +2 moreA remote code execution vulnerability exists in Microsoft SharePoint when the software fails to...8.8 High
- alle information co., ltd. school manage systemALLE INFORMATION CO., LTD. School Manage System - Security Misconfiguration9.8 Critical
- Show moreLoading…