CVE-2023-1720

HIGH Year: 2023
CVSS v3 Score
8.0
High
Weakness Type
CWE-434
View all →

Vulnerability Description

Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via uploading a crafted HTML file through /desktop_app/file.ajax.php?action=uploadfile.

Related Vulnerabilities

CVE-2013-6234

HIGH
CVSS:8.0(High)

Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, the...

CWE-4342013

CVE-2019-4069

HIGH
CVSS:8.0(High)

IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious content. IBM X-Force ID: 157014.

CWE-4342019

CVE-2020-12846

HIGH
CVSS:8.0(High)

Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upl...

CWE-4342020

CVE-2020-4703

HIGH
CVSS:8.0(High)

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the vulnerable server. T...

CWE-4342020

CVE-2020-4955

HIGH
CVSS:8.0(High)

IBM Spectrum Protect Operations Center 7.1 and 8.1could allow a remote attacker to execute arbitrary code on the system, caused by improper parameter validation. By creating an unspecified servlet req...

CWE-4342020

CVE-2020-7847

HIGH
CVSS:8.0(High)

The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. This issue affects: pTIME NAS 1.4.36.

CWE-4342020