CWE-434 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-434/ Sun, 26 Feb 2023 06:51:46 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-434 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-434/ 32 32 CVE-2018-9206 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-9206/ Sun, 26 Feb 2023 06:51:46 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-9206/ Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

The post CVE-2018-9206 appeared first on CVE Vulnerability.

]]> Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

The post CVE-2018-9206 appeared first on CVE Vulnerability.

]]> CVE-2018-9207 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-9207/ Sun, 26 Feb 2023 06:51:46 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-9207/ Arbitrary file upload in jQuery Upload File <= 4.0.2

The post CVE-2018-9207 appeared first on CVE Vulnerability.

]]> Arbitrary file upload in jQuery Upload File <= 4.0.2

The post CVE-2018-9207 appeared first on CVE Vulnerability.

]]> CVE-2018-9208 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-9208/ Sun, 26 Feb 2023 06:51:46 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-9208/ Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut <= v1.1Beta

The post CVE-2018-9208 appeared first on CVE Vulnerability.

]]> Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut <= v1.1Beta

The post CVE-2018-9208 appeared first on CVE Vulnerability.

]]> CVE-2018-9209 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-9209/ Sun, 26 Feb 2023 06:51:46 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-9209/ Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server <= v1.2.2

The post CVE-2018-9209 appeared first on CVE Vulnerability.

]]> Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server <= v1.2.2

The post CVE-2018-9209 appeared first on CVE Vulnerability.

]]> CVE-2018-9153 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-9153/ Sun, 26 Feb 2023 06:51:45 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-9153/ The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the app_id parameter to zb_users/plugin/AppCentre/plugin_edit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directly by an administrator, or through CSRF.

The post CVE-2018-9153 appeared first on CVE Vulnerability.

]]> The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the app_id parameter to zb_users/plugin/AppCentre/plugin_edit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directly by an administrator, or through CSRF.

The post CVE-2018-9153 appeared first on CVE Vulnerability.

]]> CVE-2018-9156 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-9156/ Sun, 26 Feb 2023 06:51:45 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-9156/ ** DISPUTED ** An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn’t verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with “<!–#exec cmd=" […]

The post CVE-2018-9156 appeared first on CVE Vulnerability.

]]> ** DISPUTED ** An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn’t verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with “<!–#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality.

The post CVE-2018-9156 appeared first on CVE Vulnerability.

]]> CVE-2018-9157 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-9157/ Sun, 26 Feb 2023 06:51:45 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-9157/ ** DISPUTED ** An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn’t verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with “<!–#exec cmd=" […]

The post CVE-2018-9157 appeared first on CVE Vulnerability.

]]> ** DISPUTED ** An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn’t verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with “<!–#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality.

The post CVE-2018-9157 appeared first on CVE Vulnerability.

]]> CVE-2018-9037 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-9037/ Sun, 26 Feb 2023 06:51:42 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-9037/ Monstra CMS 3.0.4 allows remote code execution via an upload_file request for a .zip file, which is automatically extracted and may contain .php files.

The post CVE-2018-9037 appeared first on CVE Vulnerability.

]]> Monstra CMS 3.0.4 allows remote code execution via an upload_file request for a .zip file, which is automatically extracted and may contain .php files.

The post CVE-2018-9037 appeared first on CVE Vulnerability.

]]> CVE-2018-8944 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-8944/ Sun, 26 Feb 2023 06:51:40 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-8944/ PHPOK 4.8.338 has an arbitrary file upload vulnerability.

The post CVE-2018-8944 appeared first on CVE Vulnerability.

]]> PHPOK 4.8.338 has an arbitrary file upload vulnerability.

The post CVE-2018-8944 appeared first on CVE Vulnerability.

]]> CVE-2018-8766 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-8766/ Sun, 26 Feb 2023 06:51:35 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-8766/ joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/admin_vod.php?action=add.

The post CVE-2018-8766 appeared first on CVE Vulnerability.

]]> joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/admin_vod.php?action=add.

The post CVE-2018-8766 appeared first on CVE Vulnerability.

]]>