Skip to main content
Apexward Pulse
4 reportsPriority Medium

Unrestricted file upload vulnerabilities

Multiple software products have been found to contain vulnerabilities that allow unauthorised file uploads, posing risks to organisations that use them.

First report Latest

What is going on

  • OpenPLC ScadaBR was reported to have an unrestricted file upload vulnerability that could let authenticated users execute arbitrary JSP files.
  • Sierra Wireless AirLink ALEOS was found to have a similar vulnerability that allows execution of uploaded code, with reports of exploitation in the wild.
  • SmarterTools SmarterMail was identified as having an unrestricted upload vulnerability that could let attackers upload files to any location on the mail server.
  • ThreatSonar Anti-Ransomware was found to have a file validation issue that could allow execution of uploaded files, with CISA reporting exploitation in the wild.
  • What to watch: Whether further details emerge about the extent of exploitation or if additional products are found to have similar vulnerabilities.

Reports in this story

Newest first. Each one is a separate event with its own sources and evidence.

Back to the feed