CVE Intelligence
Home / CVEs

CVE Database

Published vulnerabilities with severity, known exploitation and official sources.

Severity
Clear

907 result(s)

Export this search: RSS · CSV · STIX
CVE-2018-4063 High · 8.8 KEV High · 56 CWE-434 May 6, 2019
Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2019-8394 Medium · 6.5 KEV Urgent · 73 Public exploit CWE-434 Feb 17, 2019
Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
CVE-2018-15961 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-434 Sep 25, 2018
Adobe ColdFusion Unrestricted File Upload Vulnerability
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2017-12617 High · 8.1 KEV Urgent · 76 Public exploit CWE-434 Oct 3, 2017
Apache Tomcat Remote Code Execution Vulnerability
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVE-2017-12615 High · 8.1 KEV Urgent · 84 Public exploit Ransomware CWE-434 Sep 19, 2017
Apache Tomcat on Windows Remote Code Execution Vulnerability
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVE-2017-11357 Critical · 9.8 KEV Urgent · 81 Public exploit Ransomware CWE-434 Aug 23, 2017
Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
CVE-2016-3088 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-434 Jun 1, 2016
Apache ActiveMQ Improper Input Validation Vulnerability
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.