PT-2014-6845

Name of the Vulnerable Software and Affected Versions The Slide Show Creator aka com.amem application version 4.4.3 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

Information disclosure

The Show do Milhao 2014 aka br.com.lgrmobile.sdm application 1.4.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5563

The CVE concerns the Android application Show do Milhao 2014 (package br.com.lgrmobile.sdm), version 1.4.6. The root cause is that the app does not verify X.509 certificates from SSL servers, which enables a man‑in‑the‑middle attacker to spoof servers and obtain sensitive information via a crafte...

CVE-2014-5563: Undefined Security Weakness

The Show do Milhao 2014 aka br.com.lgrmobile.sdm application 1.4.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Mulitple WordPress Themes (admin-ajax.php, img param) - Arbitrary File Download

No description provided by source. WordPress CuckooTap Theme & eShop Arbitrary File Download Risk: High CWE number: CWE-200 Author: Hugo Santiago Contact: [email protected] Date: 31/08/2014 Vendor Homepage: http://themeforest.net/item/cuckootap-one-page-parallax-wp-theme-plus-eshop/3512405...

VulnCheck KEV: CVE-2014-9734

Directory traversal vulnerability in the Slider Revolution revslider plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php...

VulnCheck KEV: CVE-2015-1579

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734...

Mulitple WordPress Themes - admin-ajax.php?img Arbitrary File Download

Mulitple WordPress Themes - admin-ajax.php?img Arbitrary File Download WordPress CuckooTap Theme & eShop Arbitrary File Download Risk: High CWE number: CWE-200 Author: Hugo Santiago Contact: [email protected] Date: 31/08/2014 Vendor Homepage:...

MyBB 1.8 Beta 3 - Multiple Vulnerabilities

Title: MyBB 1.8 Beta 3 - Cross Site Scripting & SQL Injection Google Dork: intext:"Powered By MyBB" Date: 15.08.2014 Author: DemoLisH Vendor Homepage: http://www.mybb.com/ Software Link: http://www.mybb.com/downloads Version: 1.8 - Beta 3 Contact: [email protected] a Cross Site Scripting in...

PT-2014-6281

Name of the Vulnerable Software and Affected Versions ol-commerce version 2.1.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters in different PHP files, including the a country parameter in the "affiliate signup.php" file...

OL-Commerce 2.1.1 Cross Site Scripting / SQL Injection Vulnerabilities

OL-Commerce version 2.1.1 suffers from cross site scripting and remote SQL injection vulnerabilities. OL-Commerce v2.1.1 - Multiple Vulnerabilties =================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : email protected , email protected .:...

PT-2014-5996

Name of the Vulnerable Software and Affected Versions WP Consultant plugin version 1.0 and earlier Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the dialog id parameter in the admin/admin show dialogs.php...

am4ss <= 1.2 - Multiple Vulnerabilities

No description provided by source. Exploit Title : am4ss 1.2 = Multiple Vulnerabilities Author : s3n4t00r Home : Sec-w.com Version : all version Date : Jul 31, 2012 XSS Stored 1 1- Register 2 - Login here http://localhost/am4ss/orderdev.php?step=2 3- Create Ticket and add your code html or js 4-...

simple forum 3.2 (fd/xss) Multiple Vulnerabilities

No description provided by source. SIMPLE FORUM v 3.2 MULTIPLE VULNERABILITIES author : tomplixsee my email : [email protected] software : SIMPLE FORUM v3.2 download : http://www.gerd-tentler.de/tools/forum/ 1.XSS vulnerable code on forum.php ? ..... ifisset$REQUEST'dateshow' $dateshow =...

CVE-2013-2105

The Show In Browser showinbrowser gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html...

Improper access control

The Show In Browser showinbrowser gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html...

CVE-2013-2105

The Show In Browser showinbrowser gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html...

CVE-2013-2105

The CVE-2013-2105 entry concerns the Show In Browser gem for Ruby (version 0.0.3). The root cause is a symlink attack on /tmp/browser.html, which allows local users to inject arbitrary web script or HTML. Practical impact is described as a local vulnerability enabling script execution via manipul...

PT-2014-2552

Name of the Vulnerable Software and Affected Versions show in browser gem version 0.0.3 Description The issue allows local users to inject arbitrary web script or HTML via a symlink attack on the /tmp/browser.html file. This can potentially lead to the execution of malicious code. Recommendations...

CVE-2013-2105: Improper Link Resolution Before File Access

The Show In Browser showinbrowser gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html...