CVE-2017-12929

high · 8.8

Arbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version >1.5.10 allows remote authenticated users to upload arbitrary files leading to Remote Command Execution.

8.8

CVSS

10.1%

EPSS (exploit prob.)

95th

EPSS percentile

2017-09-21

Published

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
tecnovision	dlx_spot_player4	all versions

Check a specific version with /api/v1/cve/match.

References

http://packetstormsecurity.com/files/144258/DlxSpot-Shell-Upload.html
http://packetstormsecurity.com/files/144258/DlxSpot-Shell-Upload.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-12929