CVE-2017-6486

CVE-2017-6486 affects reasoncms prior to 4.7.1. An insufficient filtration of user-supplied data (nyroModalSel) passed to reasoncms-master/www/nyroModal/demoSent.php enables an attacker to execute arbitrary HTML/script in the victim’s browser. Documented impact is cross-site scripting with potent...

CVE-2016-6486

Siemens SINEMA Server contains a local privilege-escalation flaw (CVE-2016-6486) caused by improper access control on the server application folder. According to ICS-CERT/ZDI/OpenVAS details, authenticated OS users may leverage weak permissions to execute code with higher privileges, not remotely...

Siemens SINEMA Server Privilege Escalation Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-215-02 Siemens SINEMA Server Privilege Escalation Vulnerability that was published August 2, 2016, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 2 -------- Security researcher rgod working...

Siemens SINEMA Server Privilege Escalation Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-215-02 Siemens SINEMA Server Privilege Escalation Vulnerability that was published August 2, 2016, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 2 -------- Security researcher rgod working...

CVE-2015-6486

SQL injection vulnerability on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-6486

CVE-2015-6486 describes an SQL injection in Rockwell Automation’s MicroLogix 1100 and 1400 PLCs. The vulnerability allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Affected products: MicroLogix 1100 (hardware Series B, firmware 14.000 and earlier; mitig...

CVE-2014-6486

Technical details about CVE-2014-6486 are not publicly available in the provided documents. No concrete affected products, versions, exploit information, or fixes are specified here. Monitor for updates in subsequent documents.

KLA10433 Multiple vulnerabilities in Pidgin

Multiple serious vulnerabilities have been found in Pidgin. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary programs and other unknown impact. Below is a complete list of vulnerabilities 1. Improper traffic restrictions can be exploited remotely via...

CVE-2013-6486

gtkutils.c in Pidgin before 2.10.8 on Windows allows user-assisted remote attackers to execute arbitrary programs via a message containing a file: URL that is improperly handled during construction of an explorer.exe command. NOTE: this vulnerability exists because of an incomplete fix for...

CVE-2013-6486

gtkutils.c in Pidgin before 2.10.8 on Windows allows user-assisted remote attackers to execute arbitrary programs via a message containing a file: URL that is improperly handled during construction of an explorer.exe command. NOTE: this vulnerability exists because of an incomplete fix for...

CVE-2013-6486

CVE-2013-6486 concerns Pidgin on Windows (PIDGIN, before version 2.10.8). The issue occurs in gtkutils.c where a message containing a file: URL is improperly handled during construction of an explorer.exe command, allowing a user‑assisted remote attacker to execute arbitrary programs. This vulner...

pidgin

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/pidgin-2.10.9-i486-1slack14.1.txz: Upgraded. This update fixes various security issues and other bugs. For...

Pidgin for Windows URL Handling Remote Code Execution Vulnerability

Talos Vulnerability Report VRT-2013-1003 Pidgin for Windows URL Handling Remote Code Execution Vulnerability January 26, 2014 CVE Number CVE-2013-6486 Description An exploitable remote code execution vulnerability exists in Pidgin’s implementation of HTTP URL handling. An attacker can supply a...

CVE-2008-6486

PHP remote file inclusion vulnerability in slideshowuploadvideo.content.php in SharedLog, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALSrootdir parameter...

CVE-2008-6486

CVE-2008-6486 refers to a PHP remote file inclusion in SharedLog’s slideshow_uploadvideo.content.php when register_globals is enabled, allowing an attacker to execute arbitrary PHP code via a URL supplied to GLOBALS[root_dir]. The connected records corroborate the vulnerability description across...

CVE-2007-6486

CVE-2007-6486 affects LineShout 1.0’s shout.php (the shoutbox). The vulnerability is multiple cross-site scripting (XSS) weaknesses that allow remote attackers to inject arbitrary web script or HTML via the username (nickname) or message parameter. The description notes that some details are from...

CVE-2006-6486

SQL injection vulnerability in EasyPage allows remote attackers to execute arbitrary SQL commands via sptrees/default.aspx, possibly involving the docId parameter. Affects EasyPage (component/context not fully specified); root cause is an injection flaw in the handling of inputs to the page. CVSS...