Total
2765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-36042 | 1 Adobe | 2 Adobe Commerce, Magento Open Source | 2021-09-08 | 6.5 MEDIUM | 7.2 HIGH |
| Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution. | |||||
| CVE-2021-32955 | 1 Deltaww | 1 Diaenergie | 2021-09-03 | 7.5 HIGH | 9.8 CRITICAL |
| Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code. | |||||
| CVE-2015-9471 | 1 Digitalzoomstudio | 1 Zoomsounds | 2021-09-02 | 7.5 HIGH | 9.8 CRITICAL |
| The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload. | |||||
| CVE-2021-40175 | 1 Zohocorp | 1 Manageengine Log360 | 2021-09-01 | 7.5 HIGH | 9.8 CRITICAL |
| Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution. | |||||
| CVE-2020-18114 | 1 Dedecms | 1 Dedecms | 2021-09-01 | 7.5 HIGH | 9.8 CRITICAL |
| An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format. | |||||
| CVE-2021-33884 | 1 Bbraun | 3 Infusomat Large Volume Pump 871305u, Spacecom2, Spacestation 8713142u | 2021-09-01 | 5.0 MEDIUM | 9.1 CRITICAL |
| An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the device through the webpage API. This can result in critical files being overwritten. | |||||
| CVE-2020-27461 | 1 Seopanel | 1 Seopanel | 2021-08-30 | 6.5 MEDIUM | 8.8 HIGH |
| A remote code execution vulnerability in SEOPanel 4.6.0 has been fixed for 4.7.0. This vulnerability allowed for remote code execution through an authenticated file upload via the Settings Panel>Import website function. | |||||
| CVE-2021-27618 | 1 Sap | 1 Netweaver Process Integration | 2021-08-27 | 4.0 MEDIUM | 4.9 MEDIUM |
| The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not check the file type extension of the file uploaded from local source. An attacker could craft a malicious file and upload it to the application, which could lead to denial of service and impact the availability of the application. | |||||
| CVE-2021-38366 | 1 Sitecore | 1 Sitecore | 2021-08-25 | 6.8 MEDIUM | 8.8 HIGH |
| Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting an uploaded .aspx file at an admin/Packages URL. | |||||
| CVE-2020-18879 | 1 Bludit | 1 Bludit | 2021-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| Unrestricted File Upload in Bludit v3.8.1 allows remote attackers to execute arbitrary code by uploading malicious files via the component 'bl-kereln/ajax/upload-logo.php'. | |||||
| CVE-2020-18886 | 1 Phpmywind | 1 Phpmywind | 2021-08-24 | 6.5 MEDIUM | 7.2 HIGH |
| Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload_file_do.php'. | |||||
| CVE-2020-18704 | 1 Fusionbox | 1 Widgy | 2021-08-23 | 7.5 HIGH | 9.8 CRITICAL |
| Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'. | |||||
| CVE-2021-38753 | 1 Simple Image Gallery Web App Project | 1 Simple Image Gallery Web App | 2021-08-23 | 7.5 HIGH | 9.8 CRITICAL |
| An unrestricted file upload on Simple Image Gallery Web App can be exploited to upload a web shell and executed to gain unauthorized access to the server hosting the web app. | |||||
| CVE-2021-29377 | 1 Pearadmin | 1 Pearadmin Think | 2021-08-23 | 7.5 HIGH | 9.8 CRITICAL |
| Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely. A .php file can be uploaded via admin.php/index/upload because app/common/service/UploadService.php mishandles fileExt. | |||||
| CVE-2020-28165 | 1 Easycorp | 1 Zentao | 2021-08-20 | 7.5 HIGH | 9.8 CRITICAL |
| The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by using the downloadZipPackage() function. | |||||
| CVE-2020-21976 | 1 Newsone Cms Project | 1 Newsone Cms | 2021-08-19 | 9.0 HIGH | 8.8 HIGH |
| An arbitrary file upload in the <input type="file" name="user_image"> component of NewsOne CMS v1.1.0 allows attackers to webshell and execute arbitrary commands. | |||||
| CVE-2021-38305 | 1 23andme | 1 Yamale | 2021-08-17 | 9.3 HIGH | 7.8 HIGH |
| 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. | |||||
| CVE-2020-18462 | 1 Aikcms | 1 Aikcms | 2021-08-17 | 6.5 MEDIUM | 7.2 HIGH |
| File Upload vulnerabilty in AikCms v2.0.0 in poster_edit.php because the background file management office does not verify the uploaded file. | |||||
| CVE-2018-1265 | 2 Cloudfoundry, Pivotal Software | 2 Cf-deployment, Cloud Foundry Diego | 2021-08-17 | 6.5 MEDIUM | 7.2 HIGH |
| Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privileges can upload a malicious buildpack that will allow a complete takeover of a Diego Cell VM and access to all apps running on that Diego Cell. | |||||
| CVE-2020-20979 | 1 8cms | 1 Ljcms | 2021-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| An arbitrary file upload vulnerability in the move_uploaded_file() function of LJCMS v4.3 allows attackers to execute arbitrary code. | |||||