Total
1580 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-35133 | 1 Irfanview | 1 Irfanview | 2020-12-18 | 5.0 MEDIUM | 7.5 HIGH |
| irfanView 4.56 contains an error processing parsing files of type .pcx. Which leads to out-of-bounds writing at i_view32+0xdb60. | |||||
| CVE-2020-28072 | 1 Alumni Management System Project | 1 Alumni Management System | 2020-12-17 | 6.5 MEDIUM | 7.2 HIGH |
| A Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An authenticated attacker can upload arbitrary file in the gallery.php page and executing it on the server reaching the RCE. | |||||
| CVE-2020-26826 | 1 Sap | 1 Netweaver Application Server Java | 2020-12-14 | 4.0 MEDIUM | 6.5 MEDIUM |
| Process Integration Monitoring of SAP NetWeaver AS JAVA, versions - 7.31, 7.40, 7.50, allows an attacker to upload any file (including script files) without proper file format validation, leading to Unrestricted File Upload. | |||||
| CVE-2020-26828 | 1 Sap | 1 Disclosure Management | 2020-12-11 | 5.5 MEDIUM | 6.4 MEDIUM |
| SAP Disclosure Management, version - 10.1, provides capabilities for authorized users to upload and download content of specific file type. In some file types it is possible to enter formulas which can call external applications or execute scripts. The execution of a payload (script) on target machine could be used to steal and modify the data available in the spreadsheet | |||||
| CVE-2020-23520 | 1 Txjia | 1 Imcat | 2020-12-10 | 6.5 MEDIUM | 7.2 HIGH |
| imcat 5.2 allows an authenticated file upload and consequently remote code execution via the picture functionality. | |||||
| CVE-2020-26255 | 1 Getkirby | 2 Kirby, Panel | 2020-12-10 | 6.5 MEDIUM | 9.1 CRITICAL |
| Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access *cannot* use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14. | |||||
| CVE-2017-1000081 | 1 Onosproject | 1 Onos | 2020-12-07 | 7.5 HIGH | 9.8 CRITICAL |
| Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code execution. | |||||
| CVE-2020-28939 | 1 Openclinic Project | 1 Openclinic | 2020-12-07 | 6.5 MEDIUM | 7.2 HIGH |
| OpenClinic version 0.8.2 is affected by a medical/test_new.php insecure file upload vulnerability. This vulnerability allows authenticated users (with substantial privileges) to upload malicious files, such as PHP web shells, which can lead to arbitrary code execution on the application server. | |||||
| CVE-2020-29441 | 1 Outsystems | 1 Outsystems | 2020-12-04 | 6.4 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in the Upload Widget in OutSystems Platform 10 before 10.0.1019.0. An unauthenticated attacker can upload arbitrary files. In some cases, this attack may consume the available database space (Denial of Service), corrupt legitimate data if files are being processed asynchronously, or deny access to legitimate uploaded files. | |||||
| CVE-2020-25537 | 1 Ucms Project | 1 Ucms | 2020-12-04 | 10.0 HIGH | 9.8 CRITICAL |
| File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain server management permission. | |||||
| CVE-2020-25406 | 1 Lemocms | 1 Lemocms | 2020-12-03 | 7.5 HIGH | 7.3 HIGH |
| app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files. | |||||
| CVE-2020-28687 | 1 Artworks Gallery In Php\, Css\, Javascript\, And Mysql Project | 1 Artworks Gallery In Php\, Css\, Javascript\, And Mysql | 2020-12-02 | 9.0 HIGH | 8.8 HIGH |
| The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files. | |||||
| CVE-2020-28688 | 1 Artworks Gallery In Php\, Css\, Javascript\, And Mysql Project | 1 Artworks Gallery In Php\, Css\, Javascript\, And Mysql | 2020-12-02 | 9.0 HIGH | 8.8 HIGH |
| The add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files. | |||||
| CVE-2020-13774 | 1 Ivanti | 1 Endpoint Manager | 2020-12-02 | 9.0 HIGH | 9.9 CRITICAL |
| An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations on the uploaded image, which upon failure will leave the temporarily created files in an accessible location on the server. | |||||
| CVE-2020-28136 | 1 Tourism Management System Project | 1 Tourism Management System | 2020-12-01 | 6.5 MEDIUM | 8.8 HIGH |
| An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution via admin/create-package.php vulnerable page. | |||||
| CVE-2020-28693 | 1 Horizontcms Project | 1 Horizontcms | 2020-11-30 | 9.0 HIGH | 8.8 HIGH |
| An unrestricted file upload issue in HorizontCMS 1.0.0-beta allows an authenticated remote attacker to upload PHP code through a zip file by uploading a theme, and executing the PHP file via an HTTP GET request to /themes/<php_file_name> | |||||
| CVE-2020-28692 | 1 Gilacms | 1 Gila Cms | 2020-11-30 | 6.5 MEDIUM | 7.2 HIGH |
| In Gila CMS 1.16.0, an attacker can upload a shell to tmp directy and abuse .htaccess through the logs function for executing PHP files. | |||||
| CVE-2020-28130 | 1 Online Library Management System Project | 1 Online Library Management System | 2020-11-23 | 10.0 HIGH | 9.8 CRITICAL |
| An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution via admin/borrower/index.php?view=add because .php files can be uploaded to admin/borrower/photos (under the web root). | |||||
| CVE-2020-28140 | 1 Online Clothing Store Project | 1 Online Clothing Store | 2020-11-23 | 7.5 HIGH | 9.8 CRITICAL |
| SourceCodester Online Clothing Store 1.0 is affected by an arbitrary file upload via the image upload feature of Products.php. | |||||
| CVE-2020-26553 | 1 Aviatrix | 1 Controller | 2020-11-23 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Aviatrix Controller before R6.0.2483. Several APIs contain functions that allow arbitrary files to be uploaded to the web tree. | |||||