CVE-2015-3349

The CVE-2015-3349 entry concerns Drupal’s Htaccess module (7.x-2.x) with CSRF flaws that allow remote attackers to hijack administrator sessions to deploy or delete an .htaccess file. Affected: Htaccess module for Drupal 7.x, prior to 7.x-2.3. Root cause: Cross-site request forgery in the module’...

CVE-2015-3349: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Htaccess module before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 deploy or 2 delete an .htaccess file via unspecified vectors...

PT-2015-6170

Name of the Vulnerable Software and Affected Versions Htaccess module for Drupal versions prior to 7.x-2.3 Description The issue allows remote attackers to hijack the authentication of administrators for requests, specifically for deploying or deleting an .htaccess file. Recommendations For...

Scientific Linux Security Update : httpd on SL7.x x86_64 (20150305)

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header...

Bypass of file blacklist - ownCloud

A blacklist bypass vulnerability including UTF-8 encoding in file paths in the mentioned ownCloud versions, allows authenticated remote attackers to bypass the file blacklist and upload files such as the .htaccess files. An attacker could leverage this bypass by uploading a .htaccess and execute...

Bypass of file blacklist on Microsoft Windows Platform - ownCloud

A blacklist bypass vulnerability including UTF-8 encoding in file paths in the mentioned ownCloud Server versions, when running on a Microsoft Windows Platform, allows authenticated remote attackers to bypass the file blacklist and upload files such as the .htaccess files. An attacker could...

Server: Bypass of file blacklist

A blacklist bypass vulnerability including UTF-8 encoding in file paths in the mentioned ownCloud versions, allows authenticated remote attackers to bypass the file blacklist and upload files such as the .htaccess files. An attacker could leverage this bypass by uploading a .htaccess and execute...

Server: Bypass of file blacklist on Microsoft Windows Platform

A blacklist bypass vulnerability including UTF-8 encoding in file paths in the mentioned ownCloud Server versions, when running on a Microsoft Windows Platform, allows authenticated remote attackers to bypass the file blacklist and upload files such as the .htaccess files. An attacker could...

HumHub '.htaccess' Arbitrary File Upload Vulnerability

HumHub is a flexible, open source social networking system. HumHub exists for .htacces file uploads, allowing attackers to exploit vulnerabilities to upload arbitrary files and execute them...

HumHub 0.10.0 File Upload / Remote Code Execution Vulnerabilities

HumHub versions 0.10.0 and below suffer from .htaccess file upload and remote code execution vulnerabilities. + HumHub .htaccess file upload vulnerability and remote code execution + Discovered by: Jos Wetzels + Vendor: HumHub + Product: HumHub + Versions affected: 0.10.0 and earlier. + Advisory...

Drupal Htaccess Module Cross-Site Request Forgery Vulnerability

Drupal is written using the PHP language open source content management framework , which consists of a content management system and PHP development framework together . A cross-site request vulnerability exists in the Drupal Htaccess Module, which allows remote attackers to construct malicious...

SA-CONTRIB-2015-007 - Htaccess - Cross Site Request Forgery (CSRF)

The Htaccess module allows the creation and deployment of .htaccess files based on custom settings. Some administration links were not properly protected from Cross Site Request Forgery CSRF. A malicious user could cause an administrator to deploy or delete .htaccess files by getting the...

Omeka-2.2.1

Desc: Omeka suffers from an authenticated arbitrary PHP code execution. The vulnerability is caused due to the improper verification of uploaded files in '/admin/items/add' script thru the 'file0' POST parameter. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP...

Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter...

CVE-2014-8749

CVE-2014-8749 concerns a Server-Side Request Forgery (SSRF) in the BulletProof Security WordPress plugin, affecting admin/htaccess/bpsunlock.php. The vulnerability allows an attacker to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter. Affected product/v...

CVE-2014-8749

Server-side request forgery SSRF vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter...

CVE-2014-8749

Server-side request forgery SSRF vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter...

CVE-2014-8749: Undefined Security Weakness

Server-side request forgery SSRF vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter...

PT-2014-8708

Name of the Vulnerable Software and Affected Versions BulletProof Security plugin versions prior to .51.1 Description A server-side request forgery SSRF issue allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter in the...

CVE-2014-7959

SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tableprefix parameter...