cve.bz

CWE-434: Unrestricted Upload of File with Dangerous Type, page 90

Filter

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

What the weakness is: CWE-434 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-434, as MITRE names them. Credits.

Ask an AI about CWE-434

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-434: Unrestricted Upload of File with Dangerous Type and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/434.html and https://cve.bz/cve/cwe/434?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2017-17874ExploitEPSS 6.0%

    Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI.

  2. 9.8CVE-2017-16949ExploitEPSS 19%

    An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related…

  3. 7.2CVE-2017-15876EPSS 2.2%

    Unrestricted File Upload vulnerability in GPWeb 8.4.61 allows remote authenticated users to upload any type of file, including a PHP shell.

  4. 8.8CVE-2017-17727EPSS 1.5%

    DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.

  5. 7.5CVE-2017-17593ExploitEPSS 6.1%

    Simple Chatting System 1.0 allows Arbitrary File Upload via view/my_profile.php, which places files under uploads/.

  6. 7.8CVE-2017-13156ExploitEPSS 20%

    An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-64211847.

  7. 4.4CVE-2017-12332EPSS 0.3%

    A vulnerability in Cisco NX-OS System Software patch installation could allow an authenticated, local attacker to write a file to arbitrary locations. The vulnerability is due to insufficient restrictions in the patch installation process.…

  8. 7.2CVE-2017-15673EPSS 1.9%

    The files function in the administration section in CS-Cart 4.6.2 and earlier allows attackers to execute arbitrary PHP code via vectors involving a custom page.

  9. 7.5CVE-2017-15054EPSS 3.5%

    An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Command Execution. To exploit this vulnerability, an authenticated attacker has to t…

  10. 8.8CVE-2017-16941EPSS 1.6%

    October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a …

  11. 8.8CVE-2017-2737EPSS 0.9%

    VCM5010 with software versions earlier before V100R002C50SPC100 has an arbitrary file upload vulnerability. The software does not validate the files that uploaded. An authenticated attacker could upload arbitrary files to the system.

  12. 7.8CVE-2017-2699EPSS 1.0%

    The Huawei Themes APP in versions earlier than PLK-UL00C17B385, versions earlier than CRR-L09C432B380, versions earlier than LYO-L21C577B128 has a privilege elevation vulnerability. An attacker could exploit this vulnerability to upload th…

  13. 9.8CVE-2017-8862EPSS 1.5%

    The webupgrade function on the Cohu 3960HD does not verify the firmware upgrade files or process, allowing an attacker to upload a specially crafted postinstall.sh file that will be executed with "root" privileges.

  14. 8.8CVE-2017-1000238EPSS 1.1%

    InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is possible for an attacker to upload a script which is able to compromise the webserv…

  15. 9.8CVE-2017-1000194EPSS 1.2%

    October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server.

  16. 8.8CVE-2017-16524ExploitEPSS 30%

    Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_upload.php' allows remote authenticated attackers to upload and execute arbitrary PHP code via a filename with a .php ex…

  17. 8.8CVE-2017-10940EPSS 5.4%

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to agentsshar@1.0.0-release-20160901-20160901T051624Z-g3fd5adf (e469cf49-4de3-4658-8419-ab42837916ad). An at…

  18. 9.8CVE-2017-15990ExploitEPSS 7.7%

    Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.

  19. 9.8CVE-2017-15962ExploitEPSS 4.9%

    iStock Management System 1.0 allows Arbitrary File Upload via user/profile.

  20. 8.8CVE-2017-15957ExploitEPSS 3.9%

    my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.

  21. 8.8CVE-2011-4334ExploitEPSS 5.8%

    edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated users to upload arbitrary PHP files via a PHP file with a .gif extension in the userfile parameter.

  22. 9.8CVE-2017-15580ExploitEPSS 16%

    osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modi…

  23. 8.8CVE-2014-2664EPSS 2.9%

    Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM before 4.0 allows remote attackers to execute arbitrary code by uploading a file wit…

  24. 9.8CVE-2015-2780ExploitEPSS 15%

    Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in an unspecified dire…

  25. 7.2CVE-2017-1000119ExploitEPSS 61%

    October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.

  26. 8.1CVE-2017-12617KEVExploitEPSS >99.9%

    When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible…

  27. 8.8CVE-2017-6090ExploitEPSS 96%

    Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct re…

  28. 7.2CVE-2017-14958EPSS 1.3%

    lib.php in PivotX 2.3.11 does not properly block uploads of dangerous file types by admin users, which allows remote PHP code execution via an upload of a .php file.

  29. 8.8CVE-2017-13982EPSS 3.4%

    A directory traversal vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows users to upload unrestricted files.

  30. 6.5CVE-2017-14841ExploitEPSS 2.3%

    Mojoomla Annual Maintenance Contract (AMC) Management System allows Arbitrary File Upload in profilesetting image handling.

  31. 8.8CVE-2017-14840ExploitEPSS 3.5%

    TeamWork TicketPlus allows Arbitrary File Upload in updateProfile.

  32. 8.8CVE-2017-14839ExploitEPSS 3.5%

    TeamWork Photo Fusion allows Arbitrary File Upload in changeAvatar and changeCover.

  33. 8.8CVE-2017-14838ExploitEPSS 3.5%

    TeamWork Job Links allows Arbitrary File Upload in profileChange and coverChange.

  34. 9.8CVE-2015-8249ExploitEPSS 74%

    The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter.

  35. 8.8CVE-2017-14704ExploitEPSS 8.5%

    Multiple unrestricted file upload vulnerabilities in the (1) imageSubmit and (2) proof_submit functions in Claydip Laravel Airbnb Clone 1.0 allow remote authenticated users to execute arbitrary code by uploading a file with an executable e…

  36. 8.8CVE-2017-14079EPSS 11%

    Unrestricted file uploads in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbitrary code on vulnerable installations.

  37. 8.8CVE-2017-12929ExploitEPSS 10%

    Arbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version >1.5.10 allows remote authenticated users to upload arbitrary files leading to Remote Command Execution.

  38. 7.2CVE-2014-9619ExploitEPSS 7.4%

    Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web…

  39. 8.1CVE-2017-12615KEVExploitEPSS 99.7%

    When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted reques…

  40. 9.8CVE-2017-1002016EPSS 2.6%

    Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files.

  41. 9.8CVE-2017-1002008ExploitEPSS 17%

    Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileg…

  42. 9.8CVE-2017-1002003ExploitEPSS 12%

    Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.

  43. 9.8CVE-2017-1002002ExploitEPSS 13%

    Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/

  44. 9.8CVE-2017-1002001ExploitEPSS 11%

    Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.

  45. 9.8CVE-2017-1002000ExploitEPSS 27%

    Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php doesn't require authentication or check that the user is allowed to upload conte…

  46. 8.8CVE-2017-14399EPSS 1.0%

    In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\media\ajax_rename.php via the extension parameter, as demonstrated by changing the extension from .jpg to .php.

  47. 9.8CVE-2017-14346EPSS 2.1%

    upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file.

  48. 8.8CVE-2015-9228EPSS 3.7%

    In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.

  49. 8.8CVE-2017-14251EPSS 2.3%

    Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and …

  50. 8.8CVE-2017-14123EPSS 6.1%

    Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute …