cve.bz

CWE-434: Unrestricted Upload of File with Dangerous Type, page 83

Filter

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

What the weakness is: CWE-434 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-434, as MITRE names them. Credits.

Ask an AI about CWE-434

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-434: Unrestricted Upload of File with Dangerous Type and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/434.html and https://cve.bz/cve/cwe/434?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2010-3663EPSS 2.4%

    TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.

  2. 6.5CVE-2019-17325EPSS 1.2%

    ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX method in RexViewerCtrl30.ocx. That could lead to disclosure of sensitive information. User interaction is required to exp…

  3. 8.8CVE-2019-18204EPSS 1.7%

    Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achieve code execution.

  4. 8.8CVE-2018-18930EPSS 2.8%

    The Tightrope Media Carousel digital signage product 7.0.4.104 contains an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. An authenticated attacker can uplo…

  5. 9.8CVE-2019-14451EPSS 4.5%

    RepetierServer.exe in Repetier-Server 0.8 through 0.91 does not properly validate the XML data structure provided when uploading a new printer configuration. When this is combined with CVE-2019-14450, an attacker can upload an "external co…

  6. 8.8CVE-2019-18417EPSS 1.7%

    Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can result in code execution. The issue occurs because the application fails to adequately sanitize user-supplied input, e.g., …

  7. 7.2CVE-2019-11021EPSS 2.2%

    admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code execution. NOTE: "While inadvertently allowing a PHP file to be uploaded via Media Manager was an oversight, it still requir…

  8. 9.8CVE-2015-9499ExploitEPSS 16%

    The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.

  9. 7.2CVE-2019-16530EPSS 3.3%

    Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.

  10. 9.8CVE-2019-16700EPSS 2.5%

    The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this …

  11. 4.9CVE-2019-17536EPSS 2.3%

    Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move.

  12. 8.8CVE-2019-17490EPSS 1.5%

    app\modules\polygon\controllers\ProblemController in Jiangnan Online Judge (aka jnoj) 0.8.0 allows arbitrary file upload, as demonstrated by PHP code (with a .php filename but the image/png content type) to the web/polygon/problem/tests UR…

  13. 9.8CVE-2015-9479EPSS 2.8%

    The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php.

  14. 9.8CVE-2015-9471EPSS 4.0%

    The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload.

  15. 9.8CVE-2018-21024EPSS 1.9%

    licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request.

  16. 7.5CVE-2019-17352EPSS 1.7%

    In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this de…

  17. 8.8CVE-2019-14657EPSS 3.7%

    Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. They execute tar as root to extract files, but do not validate the extraction directory. Creating a tar file with ../../../../ allows replacement of almost any file …

  18. 8.8CVE-2019-14656EPSS 2.0%

    Yealink phones through 2019-08-04 do not properly check user roles in POST requests. Consequently, the default User account (with a password of user) can make admin requests via HTTP.

  19. 9.8CVE-2019-15751EPSS 4.5%

    An unrestricted file upload vulnerability in SITOS six Build v6.2.1 allows remote attackers to execute arbitrary code by uploading a SCORM file with an executable extension. This allows an unauthenticated attacker to upload a malicious fil…

  20. 9.8CVE-2019-15748EPSS 1.6%

    SITOS six Build v6.2.1 permits unauthorised users to upload and import a SCORM 2004 package by browsing directly to affected pages. An unauthenticated attacker could use the upload and import functionality to import a malicious SCORM packa…

  21. 7.2CVE-2019-17188EPSS 1.4%

    An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restriction and upload PHP code to the webserver, by providing image data and the imag…

  22. 8.8CVE-2019-11655EPSS 1.5%

    Unrestricted file upload vulnerability in Micro Focus ArcSight Logger, version 6.7.0 and later. This vulnerability could allow Unrestricted Upload of File with Dangerous type.

  23. 8.8CVE-2019-15766EPSS 3.1%

    The KSLABS KSWEB (aka ru.kslabs.ksweb) application 3.93 for Android allows authenticated remote code execution via a POST request to the AJAX handler with the configFile parameter set to the arbitrary file to be written to (and the config_…

  24. 7.2CVE-2019-17046EPSS 4.4%

    Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settings/index page.

  25. 7.5CVE-2019-15862EPSS 1.5%

    An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension (even if the application was configured to accept files only with a defined set of extensions)…

  26. 7.5CVE-2019-16720EPSS 1.4%

    ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file.

  27. 8.8CVE-2015-9402EPSS 2.0%

    The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.

  28. 6.5CVE-2019-14916EPSS 1.0%

    An issue was discovered in PRiSE adAS 1.7.0. A file's format is not properly checked, leading to an unrestricted file upload.

  29. 7.2CVE-2019-14252EPSS 1.5%

    An issue was discovered in the secure portal in Publisure 2.1.2. Once successfully authenticated as an administrator, one is able to inject arbitrary PHP code by using the adminCons.php form. The code is then stored in the E:\PUBLISURE\web…

  30. 7.4CVE-2019-15843EPSS 0.8%

    A malicious file upload vulnerability was discovered in Xiaomi Millet mobile phones 1-6.3.9.3. A particular condition involving a man-in-the-middle attack may lead to partial data leakage or malicious file writing.

  31. 9.8CVE-2016-10995EPSS 2.0%

    The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php.

  32. 8.8CVE-2019-6839EPSS 1.1%

    A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-041…

  33. 9.8CVE-2019-15131EPSS 1.9%

    In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may allow arbitrary files to be uploaded to Code42 servers and executed. This vulnerability could allow an attacker to create d…

  34. 7.2CVE-2019-8371EPSS 2.6%

    OpenEMR v5.0.1-6 allows code execution.

  35. 6.5CVE-2016-10959EPSS 1.1%

    The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.

  36. 7.5CVE-2016-10958EPSS 1.9%

    The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.

  37. 8.8CVE-2019-16318EPSS 1.4%

    In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vuln…

  38. 9.8CVE-2016-10955EPSS 2.4%

    The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.

  39. 9.8CVE-2016-10954EPSS 2.2%

    The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.

  40. 9.8CVE-2019-16192EPSS 2.1%

    upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code through module management files, as demonstrated by a .php file in a ZIP archive.

  41. 8.8CVE-2019-16131EPSS 6.5%

    framework/admin/modulec_control.php in OKLite v1.2.25 has an Arbitrary File Upload Vulnerability because a .php file from a ZIP archive can be written to /data/cache/.

  42. 9.8CVE-2019-13187EPSS 1.8%

    The Rich Text Formatter (Redactor) extension through v1.1.1 for Symphony CMS has an Unauthenticated arbitrary file upload vulnerability in content.fileupload.php and content.imageupload.php.

  43. 9.8CVE-2019-13976EPSS 1.7%

    eGain Chat 15.0.3 allows unrestricted file upload.

  44. 8.8CVE-2019-15813ExploitEPSS 33%

    Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a webshell.

  45. 8.8CVE-2019-15866EPSS 2.0%

    The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.

  46. 7.5CVE-2017-18592EPSS 1.4%

    The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.

  47. 8.8CVE-2019-15649EPSS 1.7%

    The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.

  48. 9.8CVE-2019-15524EPSS 3.1%

    CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads to remote code execution by visiting a photo/upload/2019/ URI.

  49. 7.5CVE-2015-9340EPSS 1.4%

    The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.

  50. 7.5CVE-2015-9339EPSS 1.4%

    The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.