51039 matches found
CVE-2016-10751
osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax=ajaxupload...
CVE-2016-11078
An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information credential fields within config.json via the System Console UI...
CVE-2016-11062
An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed...
CVE-2016-11077
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account...
CVE-2016-11031
An issue was discovered on Samsung mobile devices with KK4.4, L5.0/5.1, and M6.0 software. AntService allows a systemserver crash and reboot. The Samsung ID is SVE-2016-7044 November 2016...
CVE-2016-11086
lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information...
CVE-2016-10948
The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function...
CVE-2016-11068
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection...
CVE-2016-9023
Exponent CMS before 2.6.0 has improper input validation in cron/findhelp.php...
CVE-2016-10791
cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible CPANEL-9559...
CVE-2016-10980
The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kentopvcgeo...
CVE-2016-8901
b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/callplugin.php...
CVE-2016-11042
An issue was discovered on Samsung mobile devices with L5.0/5.1 and M6.0 software. There is a SIM Lock bypass. The Samsung ID is SVE-2016-5381 June 2016...
CVE-2016-10508
Multiple cross-site scripting XSS vulnerabilities in phpThumb before 1.7.14 allow remote attackers to inject arbitrary web script or HTML via parameters in demo/phpThumb.demo.showpic.php...
CVE-2016-11011
The wp-invoice plugin before 4.1.1 for WordPress has wpiupdateuseroption privilege escalation...
CVE-2016-10860
cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API SEC-66...
CVE-2016-10885
The wp-editor plugin before 1.2.6 for WordPress has CSRF...
CVE-2016-3986
Avast allows remote attackers to cause a denial of service memory corruption and possibly execute arbitrary code via a crafted PE file, related to authenticode parsing...