← Back
CWE-434

4,365 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

JSON object

Loading...

CVEs (4,365)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2002-1841
1Noguska
1Nola
Apr 16, 2026
Dec 31, 2002
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The document management module in NOLA 1.1.1 and 1.1.2 does not restrict the types of files that are uploaded, which allows remote attackers to upload and execute arbitrary PHP files with extensions such as .php4.
CVE-2001-0901
1Hypermail Development
1Hypermail
Apr 16, 2026
Nov 19, 2001
N/A· v4
N/A· v3
7.5 HIGH· v2
Hypermail allows remote attackers to execute arbitrary commands on a server supporting SSI via an attachment with a .shtml extension, which is archived on the server and can then be executed by requesting the URL for the...Show more
Hypermail allows remote attackers to execute arbitrary commands on a server supporting SSI via an attachment with a .shtml extension, which is archived on the server and can then be executed by requesting the URL for the attachment.Show less
CVE-2001-1099
1Symantec
1Norton Antivirus
Apr 16, 2026
Sep 7, 2001
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The default configuration of Norton AntiVirus for Microsoft Exchange 2000 2.x allows remote attackers to identify the recipient's INBOX file path by sending an email with an attachment containing malicious content, which...Show more
The default configuration of Norton AntiVirus for Microsoft Exchange 2000 2.x allows remote attackers to identify the recipient's INBOX file path by sending an email with an attachment containing malicious content, which includes the path in the rejection notice.Show less
CVE-2001-0340
1Microsoft
1Exchange Server
Apr 16, 2026
Jul 21, 2001
N/A· v4
N/A· v3
7.5 HIGH· v2
An interaction between the Outlook Web Access (OWA) service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that...Show more
An interaction between the Outlook Web Access (OWA) service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that contains HTML code, which is executed automatically.Show less
CVE-1999-0036
1Sgi
1Irix
Apr 16, 2026
May 26, 1997
N/A· v4
8.4 HIGH· v3
7.2 HIGH· v2
IRIX login program with a nonzero LOCKOUT parameter allows creation or damage to files.