Thelia 2.2.1 Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Thelia 2.2.1 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor: 09/29/2015 Disclosed to public: 11/13/2015 Release mode: Full...

CVE-2015-5949

VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers...

pfSense XSS and CSRF Vulnerabilities (pfSense-SA-15_04.webgui)

pfSense is prone to multiple cross-site scripting XSS vulnerabilities and a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Wordpress Front-end Editor File Upload Exploit

The Wordpress Front-end Editor plugin contains an authenticated file upload vulnerability. We can upload arbitrary files to the upload folder, because the plugin also uses it's own file upload mechanism instead of the wordpress api it's possible to upload any file type. This module requires...

The vulnerability of the CentOS operating system allows a malicious attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the libsoup-devel-2.2.1 package on the CentOS operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited remotely...

UWA 2.2.1 /lib/ctrlr/Member/MemberCtrlr.class.php SQL注入漏洞

No description provided by source. 由于此漏洞需要验证码 不太好自动化 获取数据库名 membermodelid=1&memberid0=exp&memberid1=111,122,select database,1,1,1,1,1,1,1,1,1,1,1%23 获取表前缀 membermodelid=1&memberid0=exp&memberid1=111,122,select tablename from informationschema.tables where tableschema= 0xxxxxx limit...

KLA10528 Code injection vulnerability in pfsense

Cross-site scripting vulnerabilities were found in pfSense. By exploiting these vulnerabilities malicious users can enject arbitrary sctip or HTML. These vulnerabilities can be exploited remotely via a specially designed parameters for web interface. Original advisories pfSense advisory...

Design/Logic Flaw

Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors...

CVE-2013-2027

Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors...

CVE-2015-1053

Cross-site scripting XSS vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/filemanager/filemanager/editfile...

CMS Croogo 2.2.0 Cross Site Scripting

Advisory: Reflecting XSS vulnerability in CMS Croogo v.2.2.0 Advisory ID: SROEADV-2015-02 Author: Steffen Rösemann Affected Software: CMS Croogo v.2.20 Vendor URL: https://croogo.org Vendor Status: solved CVE-ID: - ========================== Vulnerability Description: ========================== T...

Wickr Desktop 2.2.1 Windows - Denial of Service

Document Title: =============== Wickr Desktop v2.2.1 Windows - Denial of Service Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1377 Video: http://www.vulnerability-lab.com/getcontent.php?id=1388 Release Date: ============= 2014-12-25...

JS MultiHotel 2.2.1 - includes/delete_img.php path Parameter Reflected XSS

The js-multihotel WordPress plugin was affected by an includes/deleteimg.php path Parameter Reflected XSS security vulnerability...

PMachine 2.2.1 Lib.Inc.PHP Remote Include Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7919/info It has been reported that PMachine does not properly handle include files under some circumstances. Because of this, an attacker may be able to remotely execute commands...

427BB 2.2 Showthread.PHP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/16169/info 427BB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result...

maplab ms4w 2.2.1 - Remote File Inclusion Vulnerability

No description provided by source. Bug Found By ka0x D.O.M TEAM we are: anonyph;arp;ka0x;xarnuz Contact: [email protected] FROM SPAIN --- Script: MapLab Version: 2.2.1 Official Site: http://www.maptools.org Download: http://www.maptools.org/dl/ms4w/maplabms4w-2.2.1.zip -- Bug File: params.php Path...

FreeWebshop 2.2.1 - Remote Blind SQL Injection Exploit

No description provided by source. !/usr/bin/perl Indonesian Newhack Security Advisory ------------------------------------ FreeWebshop version 2.2.1 - Multiple Remote SQL Injection Vulnerabilities Waktu : Dec 16 2007 01:50AM Software : FreeWebshop version 2.2.1 Vendor : http://www.freewebshop.or...

OSSIM 2.2.1 '$_SERVER['PHP_SELF']' Parameter Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/39145/info OSSIM is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

VideoDB <= 2.2.1 (pdf.php) Remote File Include Exploit

1.漏洞分析 php define'FPDF', $config'pdfmodule';//这里可控 define'FPDFFONTPATH', FPDF.'/font/'; requireonce FPDF.'/fpdf.php'; //这里包含漏洞 requireonce './core/functions.php'; requireonce './engines/engines.php'; requireonce './core/VariableStream.class.php'; .... 2.漏洞利用...

Subdreamer 2.2.1 - SQL Injection / Command Execution Exploit

No description provided by source. !/usr/bin/perl Subdreamer 2.2.1 command exec exploit @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ supported targets: without forum integration with phpBB2 integration with ipb2 integration with vbulletin2 integration...