CWE-434
Unrestricted Upload of File with Dangerous Type
Description
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-1
CVEs mapped to this weakness (4,434)
page 221 of 222| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-21245 | Cri | 0.00 | 10.0 | 0.01 | Jan 15, 2021 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can… | ||
| CVE-2020-26286 | Hig | 0.00 | 7.5 | 0.01 | Dec 29, 2020 | HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files to the upload storage backend including HTML, JS and PHP files. The problem is patched in HedgeDoc 1.7.1. You should… | ||
| CVE-2020-15189 | Med | 0.00 | 6.8 | 0.03 | Sep 18, 2020 | SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload. Cross-Site Scripting(XSS) vulnerability that was used in CVE-2020-15183 can be used to increase impact by redirecting the administrator to access a specially crafted page. This… | ||
| CVE-2020-14961 | Med | 0.00 | 5.3 | 0.01 | Jun 22, 2020 | Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value. | ||
| CVE-2020-14067 | Cri | 0.00 | 9.8 | 0.01 | Jun 15, 2020 | The install_from_hash functionality in Navigate CMS 2.9 does not consider the .phtml extension when examining files within a ZIP archive that may contain PHP code, in check_upload in lib/packages/extensions/extension.class.php and lib/packages/themes/theme.class.php. | ||
| CVE-2020-11011 | Cri | 0.00 | 9.9 | 0.02 | Apr 22, 2020 | In Phproject before version 1.7.8, there's a vulnerability which allows users with access to file uploads to execute arbitrary code. This is patched in version 1.7.8. | ||
| CVE-2020-11722 | Cri | 0.00 | 9.8 | 0.04 | Apr 12, 2020 | Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file. | ||
| CVE-2020-10562 | Hig | 0.00 | 7.2 | 0.01 | Mar 13, 2020 | An issue was discovered in DEVOME GRR before 3.4.1c. admin_edit_room.php mishandles file uploads. | ||
| CVE-2019-16790 | Med | 0.00 | 6.5 | 0.01 | Dec 30, 2019 | In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted. | ||
| CVE-2019-17536 | Med | 0.00 | 4.9 | 0.02 | Oct 13, 2019 | Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move. | ||
| CVE-2018-21024 | Cri | 0.00 | 9.8 | 0.02 | Oct 8, 2019 | licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request. | ||
| CVE-2019-1010062 | Cri | 0.00 | 9.8 | 0.02 | Jul 16, 2019 | PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is:… | ||
| CVE-2019-13464 | Hig | 0.00 | 7.5 | 0.01 | Jul 9, 2019 | An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid. | ||
| CVE-2019-12548 | Hig | 0.00 | 8.8 | 0.03 | Jun 3, 2019 | Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo. | ||
| CVE-2019-9185 | Hig | 0.00 | 8.8 | 0.03 | Mar 7, 2019 | Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension. | ||
| CVE-2018-16388 | Hig | 0.00 | 7.2 | 0.02 | Sep 12, 2018 | e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type. | ||
| CVE-2018-1000658 | Hig | 0.00 | 8.8 | 0.02 | Sep 6, 2018 | LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via webshell. This attack appear to be exploitable via an authenticated user uploading a zip archive which can contains malicious… | ||
| CVE-2018-12256 | Hig | 0.00 | 8.8 | 0.03 | Aug 16, 2018 | admin/vqmods.app/vqmods.inc.php in LiteCart before 2.1.3 allows remote authenticated attackers to upload a malicious file (resulting in remote code execution) by using the text/xml or application/xml Content-Type in a public_html/admin/?app=vqmods&doc=vqmods request. | ||
| CVE-2018-11331 | Cri | 0.00 | 9.8 | 0.02 | May 21, 2018 | An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess. | ||
| CVE-2018-7562 | Hig | 0.00 | 7.5 | 0.02 | Mar 12, 2018 | A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable file that will be disallowed. The application allows an authenticated user to upload a file when he/she creates a new ticket via… |
- risk 0.00cvss 10.0epss 0.01
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can…
- risk 0.00cvss 7.5epss 0.01
HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files to the upload storage backend including HTML, JS and PHP files. The problem is patched in HedgeDoc 1.7.1. You should…
- risk 0.00cvss 6.8epss 0.03
SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload. Cross-Site Scripting(XSS) vulnerability that was used in CVE-2020-15183 can be used to increase impact by redirecting the administrator to access a specially crafted page. This…
- risk 0.00cvss 5.3epss 0.01
Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.
- risk 0.00cvss 9.8epss 0.01
The install_from_hash functionality in Navigate CMS 2.9 does not consider the .phtml extension when examining files within a ZIP archive that may contain PHP code, in check_upload in lib/packages/extensions/extension.class.php and lib/packages/themes/theme.class.php.
- risk 0.00cvss 9.9epss 0.02
In Phproject before version 1.7.8, there's a vulnerability which allows users with access to file uploads to execute arbitrary code. This is patched in version 1.7.8.
- risk 0.00cvss 9.8epss 0.04
Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file.
- risk 0.00cvss 7.2epss 0.01
An issue was discovered in DEVOME GRR before 3.4.1c. admin_edit_room.php mishandles file uploads.
- risk 0.00cvss 6.5epss 0.01
In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted.
- risk 0.00cvss 4.9epss 0.02
Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move.
- risk 0.00cvss 9.8epss 0.02
licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request.
- risk 0.00cvss 9.8epss 0.02
PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is:…
- risk 0.00cvss 7.5epss 0.01
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid.
- risk 0.00cvss 8.8epss 0.03
Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo.
- risk 0.00cvss 8.8epss 0.03
Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension.
- risk 0.00cvss 7.2epss 0.02
e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type.
- risk 0.00cvss 8.8epss 0.02
LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via webshell. This attack appear to be exploitable via an authenticated user uploading a zip archive which can contains malicious…
- risk 0.00cvss 8.8epss 0.03
admin/vqmods.app/vqmods.inc.php in LiteCart before 2.1.3 allows remote authenticated attackers to upload a malicious file (resulting in remote code execution) by using the text/xml or application/xml Content-Type in a public_html/admin/?app=vqmods&doc=vqmods request.
- risk 0.00cvss 9.8epss 0.02
An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.
- risk 0.00cvss 7.5epss 0.02
A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable file that will be disallowed. The application allows an authenticated user to upload a file when he/she creates a new ticket via…