openSUSE Security Update : rubygem-actionpack/activerecord-2_3 (openSUSE-SU-2012:0978-1)

3 Security issues were fixed in rails 2.3 core components. 2 NULL query issues where fixed in the actionpack gem. 1 SQL injection was fixed in the activerecord gem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

FineCMS 2.3.x 本地文件包含漏洞

简要描述： FineCMS2.3.x版本一文件中存在本地文件包含漏洞。需要在能截断的环境中使用。 详细说明： palyer/video.php player目录下的video.php 中存在本地文件包含漏洞（必须能支持截断的环境才能使用）。漏洞形成原因见 video.php 的98到100行代码。 $filename='./Models/'.$type.'Model.php'; iffileexists$filename includeonce$filename; 其中$type=$GET'vtype'; 漏洞证明： 在windows环境中测试的。...

DOYO 2.3 /message.php SQL注入漏洞

Doyo 2.3...

CVE-2014-3007

Python Image Library PIL 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py...

doyo 2.3 /template.php 本地文件包含漏洞

DOYO在template传参时，由于Template.php对传入文件路径的处理不当，逻辑错误，导致可包含任意文件（含相对路径）。 doyo 2.3...

OpenVPN 2.3.x Heartbeat Information Disclosure (Heartbleed)

According to its self-reported version number, the version of OpenVPN installed on the remote host is affected by an out-of-bounds read error, known as the 'Heartbleed Bug' in the included OpenSSL version. This error is related to handling TLS heartbeat extensions that could allow an attacker to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by 1 providing a crafted playerId or 2 referencing a...

Ganib 2.3 SQL Injection

Exploit title: Ganib 2.x SQLi Date: 02/02/2014 Exploit author: drone @dronesec More information: http://hatriot.github.io/blog/2014/02/24/ganib-project-management-2.3-sqli/ Vendor homepage: http://www.ganib.com/ Software link:...

Google Analytics MU 2.3 Cross Site Request Forgery

Details ================ Software: Google Analytics MU Version: 2.3 Homepage: http://wordpress.org/plugins/google-analytics-mu/ CVSS: 5.8 Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N Description ================ CSRF in Google Analytics MU 2.3 Vulnerability ================ If an admin visits a page of the...

Ganib Project Management 2.3 - SQL Injection

Ganib Project Management 2.3 - SQL Injection...

CVE-2014-1466

SQL injection vulnerability in CSP MySQL User Manager 2.3 allows remote attackers to execute arbitrary SQL commands via the login field of the login page...

Sql injection

SQL injection vulnerability in CSP MySQL User Manager 2.3 allows remote attackers to execute arbitrary SQL commands via the login field of the login page...

Ecmall 2.3 File Inclusion Vulnerability（鸡肋）

简要描述： Ecmall 2.3 File Inclusion Vulnerability 详细说明： Ecmall 2.3 File Inclusion Vulnerability By：zcy Team：网络尖刀 版本：2.3 漏洞文件：app\mypayment.app.php ECMall 社区电子商务系统简称ECMall是上海商派网络科技有限公司继ECShop之后推出的又一个电子商务姊妹产品。与 ECShop 不同的是，ECMall 是一个允许店铺加盟的多店系统。现已停止更新。 漏洞文件存在app/mypayment.app.php中的install方法中第74—88行中...

WordPress Persuasion 主题'dl-skin.php'任意文件访问漏洞

BUGTRAQ ID: 64501 Persuasion是一款强大的商业主题。 Persuasion 2.0、2.3版本没有有效过滤用户输入，攻击者可利用此漏洞下载或删除任意文件。 0 mysitemyway persuasion 2.3 mysitemyway persuasion 2.0 厂商补丁： mysitemyway ----------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://mysitemyway.com/theme/persuasion-wordpress-theme/ Exploit Title:...

Wordpress Persuasion Theme - Arbitrary File Download and File Deletion Exploit

Exploit for php platform in category web applications Exploit Title: Persuasion Wordpress Theme - Arbitrary File Download and File Deletion Exploit Date: 19 December 2013 Exploit Author: Interference Security Vendor Homepage: http://mysitemyway.com/ Software Link:...

WordPress Persuasion Theme File Download / Deletion

Exploit Title: Persuasion Wordpress Theme - Arbitrary File Download and File Deletion Exploit Date: 19 December 2013 Exploit Author: Interference Security Vendor Homepage: http://mysitemyway.com/ Software Link: http://mysitemyway.com/theme/persuasion-wordpress-theme/ Version: Tested on 2.0 and 2....

MBSA 2.3 and the November 2013 Security Bulletin Webcast, Q&A, and Slide Deck

Today we’re publishing the November 2013 Security Bulletin Webcast Questions & Answers page. The majority of questions focused on the ActiveX Kill Bits bulletin MS13-090 and the advisories. We also answered a few general questions that were not specific to any of this month’s updates, but that ma...

CVE-2013-5851

Unspecified vulnerability in Oracle Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via vectors related to JAXP...

Possible DOS attack with long user-submitted passwords

More info at https://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released...

CVE-2013-2245

rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for impersonation, which allows remote authenticated users to obtain sensitive block information by reading an RSS feed...