CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- sfcyazilim sonloggerSonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send...9.8 Critical
- vmware view plannerVMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution...9.8 Critical
- visualware myconnection serverAn issue was discovered in Visualware MyConnection Server through 11.0b build 5382....9.8 Critical
- zenphotoZenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code...7.2 High
- contec co., ltd. solarview compact, contec sv-cpt-mc310 firmware +1 moreSolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to upload...8.8 High
- efm networks iptime nas, iptime nas-i firmware, nas-ii firmware +7 more +9 moreThe ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins...7.4 High
- yithemes yith woocommerce gift cardsAn arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3...9.8 Critical
- eyesofnetworkThe module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload...8.8 High
- phpgurukul car rental portalPHPGurukul Car Rental Project version 2.0 suffers from a remote shell upload vulnerability in...9.8 Critical
- janobe baby care systemAn arbitrary file upload vulnerability has been identified in posts.php in Baby Care System 1.0....7.2 High
- changate property management systemChanGate EnterPrise Co., Ltd property management system - Broken Authentication8.8 High
- ibm spectrum protect operations centerIBM Spectrum Protect Operations Center 7.1 and 8.1could allow a remote attacker to execute...8.0 High
- adobe magento commerce, magento +1 moreMagento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution9.1 Critical
- monitorrRemote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute...9.8 Critical
- probot botThe ProBot bot through 2021-02-08 for Discord might allow attackers to interfere with the...9.8 Critical
- ucopia wireless applianceUCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with admin user privileges via an...8.2 High
- fortiloggerFortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png"...9.8 Critical
- yccmsUnrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper...9.8 Critical
- google chrome, microsoft edge chromium +1 moreInsufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed...6.5 Medium
- schneider-electric ecostruxure power build - rapsodyA CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the...7.8 High
- schneider-electric ecostruxure power build - rapsodyA CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the...7.8 High
- feehi cmsFeehi CMS arbitrary file upload vulnerability7.2 High
- openmage, openmage magento-lts +1 moreCMS Editor code execution8.7 High
- openmage, openmage magento-lts +1 moreWidget instances allows a hacker to inject an executable file on the server on OpenMage8.7 High
- churchdesk churchrotaChurchRota 2.6.4 is vulnerable to authenticated remote code execution. The user does not need to...8.8 High
- openmaintopenMAINT before 1.1-2.4.2 allows remote authenticated users to run arbitrary JSP code on the...8.8 High
- openmage, openmage magento-lts +1 moreLayout XML RCE Vulnerability in OpenMage8.7 High
- open-emr openemrOpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts...8.8 High
- atlassian confluence server, confluence data center +1 moreAffected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact...6.5 Medium
- asus dsl-n14u b1 firmwareAn issue was discovered on ASUS DSL-N14U-B1 1.1.2.3_805 devices. An attacker can upload arbitrary...7.5 High
- onedev project onedevPre-Auth Arbitrary File Upload10.0 Critical
- sparkdevnetwork rock rmsRock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files...9.8 Critical
- veritas backup execAn issue was discovered in the server in Veritas Backup Exec through 16.2, 20.6 before hotfix...9.3 Critical
- ibm cloud pak systemIBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By...6.7 Medium
- ibm cloud pak systemIBM Cloud Pak System 2.3 could allow l local privileged user to disclose sensitive information...2.3 Low
- elegantthemes divi, divi builder, extra +2 moreAn issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3...9.9 Critical
- expresstech quiz and survey masterAn issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made...10.0 Critical
- netgear nms300 firmwareNETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an unauthenticated...9.8 Critical
- hedgedocArbitary file upload7.5 High
- woocommerce gift cardsUltimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom...8.8 High
- projectworlds online matrimonial projectMarital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload...8.8 High
- jaws project jawsJaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via...7.2 High
- jaws project jawsJaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via...7.2 High
- terra-master terramaster operating systemAn unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via...9.8 Critical
- supremocontrol supremoNanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager...7.8 High
- atlassian crucibleAffected versions of Atlassian Crucible allow remote attackers to impact the application's...4.3 Medium
- tangro business workflowtangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and...8.8 High
- rocklobster contact form 7The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted...10.0 Critical
- kyland kps2204 6 port managed din-rail programmable serial device firmwareAn arbitrary code execution vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable...9.8 Critical
- irfanviewirfanView 4.56 contains an error processing parsing files of type .pcx. Which leads to out-of...7.5 High
- Show moreLoading…