CVE-2015-2076

The CVE-2015-2076 vulnerability affects SAP BusinessObjects Edge 4.0, where an unauthenticated remote attacker could read auditing information via the Auditing service. The Onapsis advisory and SAP notes identify an unauthorized access risk exposing audit events (e.g., report names, universe quer...

NetIQ Access Manager 4.0 < 4.0 SP1 Hotfix 3 Multiple Vulnerabilities

The remote host is running a version of NetIQ Access Manager 4.0 without service pack 1 hotfix 3. It is, therefore, affected by the following vulnerabilities : - An XML Entity Injection XXE flaw exists in the 'query' parameter of the webacc servlet that can allow an authenticated user to view the...

Unspecified Open Redirection Vulnerability in EMC Unisphere Central

EMC Unisphere is a next-generation unified storage management platform from EMC Corporation. unisphere Central is one of the components that provides centralized, multi-chassis monitoring for multiple VNXe, VNX, CLARiion CX4 systems and XtremSW Cache cards deployed in remote and branch offices. A...

CVE-2014-8479

The FTP server on Siemens SCALANCE X-300 switches with firmware before 4.0 and SCALANCE X 408 switches with firmware before 4.0 allows remote authenticated users to cause a denial of service reboot via crafted FTP packets...

WordPress Plugin Cforms 14.7 - Remote Code Execution

Exploit Title: Remote Code Execution via Unauthorised File upload in Cforms 14.7 Date: 2015-01-19 Exploit Author: Zakhar Vendor Homepage: https://wordpress.org/plugins/cforms2/ Software Link: https://downloads.wordpress.org/plugin/cforms2.zip Version: 14.7 Tested on: Wordpress 4.0 CVE : 2014-9473...

How to relieve Microsoft XML vulnerability risk-the vulnerability warning-the black bar safety net

Recently reported, Microsoft XML Core Services vulnerability is still computer users face the biggest risk, and more than 4 3% of users are running a vulnerable version. Can you explain why these problems still exist as well as to alleviate the problem the best way? ! How to relieve Microsoft XML...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in mobiquo/smartbanner/welcome.php in the Tapatalk com.tapatalk.wbb4 plugin 1.x before 1.1.2 for Woltlab Burning Board 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 appandroidid or 2 appkindleurl parameter...

CVE-2014-8869

Multiple cross-site scripting XSS vulnerabilities in mobiquo/smartbanner/welcome.php in the Tapatalk com.tapatalk.wbb4 plugin 1.x before 1.1.2 for Woltlab Burning Board 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 appandroidid or 2 appkindleurl parameter...

CVE-2014-8870

Open redirect vulnerability in mobiquo/smartbanner/welcome.php in the Tapatalk com.tapatalk.wbb4 plugin before 1.1.2 for Woltlab Burning Board 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the boardurl parameter...

CVE-2014-8869

The CVE-2014-8869 entry concerns the Tapatalk plugin for Woltlab Burning Board 4.0 (com.tapatalk.wbb4). Affected module: mobiquo/smartbanner/welcome.php where improper encoding of two URL parameters (app_android_id and app_kindle_url) enables cross-site scripting. The vulnerability allows remote ...

CVE-2014-8870

CVE-2014-8870 concerns the Open Redirect vulnerability in the Tapatalk (com.tapatalk.wbb4) plugin for Woltlab Burning Board 4.0. The issue is triggered by supplying a malicious URL in the board_url parameter of mobiquo/smartbanner/welcome.php, allowing remote attackers to redirect users to arbitr...

CVE-2014-10005

Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to loadflv.js.php, which reveals the installation path in an error message...

CVE-2014-10004

SQL injection vulnerability in admin/datafiles/move.php in Maian Uploader 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2014-10003

Multiple cross-site scripting XSS vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2 uploader/js/loadflv.js.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2 uploader/js/loadflv.js.php...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Maian Uploader 4.0 allow remote attackers to hijack the authentication of unspecified users for requests that conduct cross-site scripting XSS attacks via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2...

Design/Logic Flaw

Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to loadflv.js.php, which reveals the installation path in an error message...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Maian Weblog 4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 email, or 3 subject parameter in a contact action to index.php...

CVE-2014-10004

Maian Uploader 4.0 is affected by a SQL injection in admin/data_files/move.php via the id parameter, enabling remote attackers to execute arbitrary SQL commands. No exploit specifics or mitigation details are provided in the connected documents; implications are partial confidentiality/integrity ...

CVE-2014-10005

CVE-2014-10005 affects Maian Uploader 4.0. The issue arises when requesting load_flv.js.php without the required height parameter, which may cause an error message that reveals the installation path. This is a potential information disclosure in the affected component (load_flv.js.php). The docum...