CVE-2016-5727

LogInOut.php in Simple Machines Forum SMF 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via vectors related to variables derived from user input in a foreach loop...

Design/Logic Flaw

LogInOut.php in Simple Machines Forum SMF 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via vectors related to variables derived from user input in a foreach loop...

Design/Logic Flaw

Packages.php in Simple Machines Forum SMF 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter...

CVE-2016-5726

CVE-2016-5726 affects SMF 2.1, where Packages.php is vulnerable to a PHP object injection via the themechanges array parameter, enabling remote code execution. The vulnerability stems from how user-supplied data within that parameter is processed, allowing an attacker to craft payloads that execu...

CVE-2016-5727

CVE-2016-5727 affects Simple Machines Forum (SMF) 2.1. The vulnerability allows remote attackers to perform PHP object injection and execute arbitrary PHP code via vectors related to variables derived from user input in a foreach loop. The description indicates an input-derived injection in LogIn...

Design/Logic Flaw

Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications subcomponent: Core. Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows physical access to compromise...

iucode-tool buffer overflow vulnerability

iucode-tool is a set of microcode tools for operating Intel-registered i686 and X86-64 system processors. A heap buffer overflow vulnerability exists in iucode-tool versions 1.4 through 2.1, which originates when the program fails to properly perform bounds detection on user-submitted data,...

Precurio 2.1: Remote Command Execution via Xinha Plugin

RIPS Analysis RIPS detected many security vulnerabilities, such as SQL injection and cross-site scripting issues. In order to exploit most of these vulnerabilities in Precurios code base, a user account is required. Precurio also includes a lot of third-party code though that is directly...

Facebook API v2.1 - RFC6749 Open Redirect Vulnerability

Document Title: =============== Facebook API v2.1 - RFC6749 Open Redirect Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1972 Vulnerability Magazine:...

CVE-2016-3110

Summary: CVE-2016-3110 affects mod_cluster (used in Red Hat JBoss Web Server 2.1). An MCMP message that contains a sequence of = characters after a legitimate element can cause the Apache httpd server to crash, resulting in a denial of service. Affected product/component: mod_cluster within Red H...

Poison Ivy C2 Server Buffer Overflow Vulnerability

Poison Ivy is a remote control tool. Poison Ivy 2.1.x suffers from a buffer overflow vulnerability that can be exploited by a remote attacker to execute arbitrary code in the context of the application...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account...

CVE-2016-6893

GNU Mailman 2.1.x contains a CSRF vulnerability (CVE-2016-6893) in the user options page that allows remote attackers to hijack a user’s session and perform option-modifying requests, potentially accessing victim credentials. The root cause is CSRF token protection not being correctly tied to the...

CVE-2016-6893

Removed by vendor...

CVE-2016-6893

Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account...

WordPress bwtf-waterquality plugin cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in version 2.1 of the WordPress bwtf-waterquality plugin, which...

Poison Ivy 2.1.x - C2 Buffer Overflow (Metasploit)

Exploit for windows platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Poison Ivy 2.1.x C2 Buffer Overflow', 'Description' = %q This module...

Poison Ivy 2.1.x (C2 Server) - Remote Buffer Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Poison Ivy 2.1.x C2 Buffer Overflow', 'Description' = %q This module exploits a stack buffer overflow in the Poison Ivy 2.1.x C...

Poison Ivy 2.1.x C2 Buffer Overflow

This module exploits a stack buffer overflow in the Poison Ivy 2.1.x C&C server. The exploit does not need to know the password chosen for the bot/server communication. Module Options msf use exploit/windows/misc/poisonivy/21xbof msf undefined21xbof show actions ...actions... msf undefined21xbof...

IBM WebSphere DataPower XC10 Buffer Overflow Vulnerability

IBM WebSphere DataPower XC10 is a caching platform from IBM in the United States. The platform allows distributed caching of data with little or no change to existing applications. A buffer overflow vulnerability exists in the CLI of IBM WebSphere DataPower XC10 version 2.1 and 2.5. An attacker...