CVE-2019-14521

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://energy-log-server-6x.readthedocs.io/en/latest/CHANGELOG.htmlRelease Notes, Third Party Advisory
https://energylogserver.pl/en/Vendor Advisory
https://gist.github.com/ahpaleus/effb46d4a9d9c2b9a452c98f64ddc2c7Exploit, Third Party Advisory
https://github.com/emca-it/Energy-Log-Server-6.x/commits/masterPatch, Third Party Advisory
https://energy-log-server-6x.readthedocs.io/en/latest/CHANGELOG.htmlRelease Notes, Third Party Advisory
https://energylogserver.pl/en/Vendor Advisory
https://gist.github.com/ahpaleus/effb46d4a9d9c2b9a452c98f64ddc2c7Exploit, Third Party Advisory
https://github.com/emca-it/Energy-Log-Server-6.x/commits/masterPatch, Third Party Advisory

Timeline

Published: Aug 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-145237.8An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga CVE-2019-145247.8An issue was discovered in Schism Tracker through 20190722. There is a heap-based buffer overflow via a large number of song patterns in fmt CVE-2019-145254.9In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to CVE-2019-145268.1An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stor CVE-2019-145279.8An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. System commands can be executed, via the web interface, af CVE-2019-145287.8GnuCOBOL 2.2 has a heap-based buffer overflow in read_literal in cobc/scanner.l via crafted COBOL source code.CVE-2019-145299.8OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.CVE-2019-14537.5A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends CVE-2019-145308.8An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (t CVE-2019-145319.8An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an out of bounds read on iso9660 while parsing System Use Sharing Protocol d CVE-2019-145329.8An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp whi CVE-2019-145337.8The Control function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 has a use-after-free.