CWE-434: Unrestricted Upload of File with Dangerous Type, page 91
Filter
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
What the weakness is: CWE-434 at MITRE
Related attack patterns (CAPEC): 1
- CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-434, as MITRE names them. Credits.
Ask an AI about CWE-434
Show the prompt
Explain CWE-434: Unrestricted Upload of File with Dangerous Type and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/434.html and https://cve.bz/cve/cwe/434?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.8CVE-2017-14050EPSS 1.2%
In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file.
- 9.8CVE-2013-7426EPSS 2.2%
Insecure Temporary file vulnerability in /tmp/kamailio_fifo in kamailio 4.0.1.
- 5.5CVE-2016-0354EPSS 0.8%
IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting room, that could be downloaded by unsuspecting users which could be executed with user privileges. IBM …
- 8.8CVE-2014-9312ExploitEPSS 45%
Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.
- 7.8CVE-2017-9650ExploitEPSS 2.4%
An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCT…
- 9.8CVE-2017-11357KEVExploitEPSS 78%
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
- 9.8CVE-2017-3108EPSS 8.6%
Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability.
- 7.2CVE-2017-11154ExploitEPSS 8.6%
Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter.
- 8.8CVE-2017-12678EPSS 2.2%
In TagLib 1.11.1, the rebuildAggregateFrames function in id3v2framefactory.cpp has a pointer to cast vulnerability, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted audio fi…
- 7.8CVE-2015-7571ExploitEPSS 8.4%
Unrestricted file upload vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
- 7.0CVE-2017-11756EPSS 0.7%
In Earcms Ear Music through 4.1 build 20170710, remote authenticated users can execute arbitrary PHP code by changing the allowable music-upload extensions to include .php in addition to .mp3 and .m4a in admin.php?iframe=config_upload, and…
- 6.5CVE-2015-4463EPSS 1.2%
The file_manager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-upload restrictions by appending a crafted parameter to the file URL.
- 6.5CVE-2015-4462EPSS 1.1%
Absolute path traversal vulnerability in the file_manager component of eFront CMS before 3.6.15.5 allows remote authenticated users to read arbitrary files via a full pathname in the "Upload file from url" field in the file manager for pro…
- 7.5CVE-2017-11326EPSS 1.1%
An issue was discovered in Tilde CMS 1.0.1. It is possible to bypass the implemented restrictions on arbitrary file upload via a filename.+php manipulation.
- 7.2CVE-2017-11466EPSS 7.7%
Arbitrary file upload vulnerability in com/dotmarketing/servlets/AjaxFileUploadServlet.class in dotCMS 4.1.1 allows remote authenticated administrators to upload .jsp files to arbitrary locations via directory traversal sequences in the fi…
- 4.9CVE-2017-11405EPSS 0.8%
In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is c…
- 4.9CVE-2017-11404EPSS 0.8%
In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php.
- 9.8CVE-2017-1000081EPSS 3.0%
Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code execution.
- 9.8CVE-2017-6041EPSS 1.8%
An Unrestricted Upload issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Master, A520 Slave, A530, A542, A571, Check Bin Grader, FlowlineQC T376, IPM3 Dual Ca…
- 8.8CVE-2017-9840EPSS 1.5%
Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable application.
- 9.8CVE-2017-4990EPSS 3.0%
In EMC Avamar Server Software 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, 7.3.0-226, an unauthorized attacker may leverage the file upload feature of the system maintenance page to load a maliciously crafted file to any directory which coul…
- 8.8CVE-2017-9380ExploitEPSS 15%
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application.
- 9.8CVE-2017-9364EPSS 1.3%
Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code.
- 9.8CVE-2015-4455ExploitEPSS 41%
Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extens…
- 9.8CVE-2017-9101ExploitEPSS 77%
import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.
- 8.8CVE-2017-9080ExploitEPSS 62%
PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection.
- 9.8CVE-2017-6027EPSS 2.6%
An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server, part of the CODESYS WebVisu web browser visualization software, are affected: CODESYS Web S…
- 8.8CVE-2017-9069EPSS 1.9%
In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess.
- 8.8CVE-2017-8080EPSS 2.6%
Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads.
- 6.5CVE-2017-7989EPSS 1.0%
In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate MIME type checks allowed low-privilege users to upload swf files even if they were explicitly forbidden.
- 9.1CVE-2017-7357EPSS 2.6%
Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by importing a file.
- 7.3CVE-2016-1713ExploitEPSS 17%
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uplo…
- 8.8CVE-2017-7281EPSS 4.3%
An issue was discovered in Unitrends Enterprise Backup before 9.1.2. A lack of sanitization of user input in the createReportName and saveReport functions in recoveryconsole/bpl/reports.php allows for an authenticated user to create a rand…
- 9.8CVE-2017-7695EPSS 2.0%
Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any code.
- 4.3CVE-2016-8973EPSS 0.7%
IBM Rhapsody DM 4.0, 5.0 and 6.0 contains an undisclosed vulnerability that may allow an authenticated user to upload infected malicious files to the server. IBM Reference #: 1999960.
- 8.8CVE-2015-3884ExploitEPSS 14%
Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with…
- 7.5CVE-2017-6104ExploitEPSS 7.3%
Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.
- 7.2CVE-2016-6104EPSS 2.7%
IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, which could allow the attacker to execute arbitrary code on the vulnerable system.
- 8.8CVE-2016-8921EPSS 2.2%
IBM FileNet WorkPlace XT could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
- 8.8CVE-2016-6124EPSS 2.2%
IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
- 8.8CVE-2017-5520EPSS 1.8%
The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to rename and execute files with the `.php6`, `.php7` and `.phtml` exte…
- 8.8CVE-2016-7902EPSS 3.1%
Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authenticated users with permissions to manage media items to execute arbitrary code by uploading a ZIP file containing a file wi…
- 7.2CVE-2016-9268EPSS 5.0%
Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with …
- 8.8CVE-2016-9187EPSS 4.0%
Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing i…
- 8.8CVE-2016-9186EPSS 3.8%
Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing…
- 7.5CVE-2016-7452EPSS 1.7%
The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder on the site via a cpi directory traversal.
- 9.8CVE-2016-7095EPSS 2.3%
Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution.
- 7.8CVE-2015-1000013EPSS 2.1%
Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1
- 9.8CVE-2015-1000001EPSS 3.0%
Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin
- 9.8CVE-2015-1000000EPSS 3.0%
Remote file upload vulnerability in mailcwp v1.99 wordpress plugin