WordPress Recent Backups Plugin 0.7 - Arbitrary File Download

Recent Backups plugin is prone to an arbitrary file download vulnerability because "download-file.php" does not verify the user is logged. It allows an attacker to download arbitrary files from the web server and get potentially sensitive information. Solution Update the plugin...

WordPress Recent Backups 0.7 File Download

Title: Remote file download vulnerability in recent-backups v0.7 wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-07-13 Download Site: https://wordpress.org/plugins/recent-backups Vendor: https://profiles.wordpress.org/andycheeseman/ Vendor Notified: 0000-00-00 Vendor Contact:...

recent-backups <= 0.7 - Remote File Download

Plugin is still affected and has been closed. The code in download-file.php does not verify if the user is logged in or sanitize which files can be downloaded. This vulnerability can be used to download sensitive system files, such as the Linux passwd file. $ curl -v...

Important: Red Hat Security Advisory: openstack-cinder security and bug fix update

Updated openstack-cinder packages that fix one security issue and multiple bugs are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 and 6.0. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score,...

Moderate: Red Hat Security Advisory: ipa security, bug fix, and enhancement update

Updated ipa packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

CVE-2014-4817

The server in IBM Tivoli Storage Manager TSM 5.x and 6.x before 6.3.5.10 and 7.x before 7.1.1.100 allows remote attackers to bypass intended access restrictions and replace file backups by using a certain backup option in conjunction with a filename that matches a previously used filename...

Design/Logic Flaw

The server in IBM Tivoli Storage Manager TSM 5.x and 6.x before 6.3.5.10 and 7.x before 7.1.1.100 allows remote attackers to bypass intended access restrictions and replace file backups by using a certain backup option in conjunction with a filename that matches a previously used filename...

CVE-2014-4817

The server in IBM Tivoli Storage Manager TSM 5.x and 6.x before 6.3.5.10 and 7.x before 7.1.1.100 allows remote attackers to bypass intended access restrictions and replace file backups by using a certain backup option in conjunction with a filename that matches a previously used filename...

XCloner Wordpress/Joomla! Plugin - Multiple Vulnerabilities

No description provided by source. Title: XCloner Wordpress/Joomla! backup Plugin v3.1.1 Wordpress v3.5.1 Joomla! Vulnerabilities Author: Larry W. Cashdollar, @larry0 Date: 10/17/2014 Download: https://wordpress.org/plugins/xcloner-backup-and-restore/ Download:...

WordPress XCloner Plugin <= 3.1.1 - Multiple Vulnerabilities

There are multiple vulnerabilities in this plugin, such as arbitrary command execution, clear text MySQL password exposure through html text box under configuration panel, MySQL password exposed to process table, database backups exposed to local users due to open file permissions, authenticated...

[CVE- Requested][Vembu Storegrid - Multiple Critical Vulnerabilities]

Advisory Overview Multiple vulnerabilities exist in the Vembu Storegrid Backup and Disaster Recovery solution affecting both the client and server software see Additional Information section include but are not limited to reflected XSS, source code/sensitive information disclosure, privilege...

Tape configuration restore

Challenge Due to architecture limitations, configuration backups created with Veeam Backup & Replication 7.0 did not capture database records that were responsible for displaying VMs processed with jobs in the Veeam Backup & Replication console. These limitations applied to all types of jobs,...

UBUNTU-CVE-2014-5247

The UpgradeBeforeConfigurationChange function in lib/client/gntcluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information...

Akeeba Patches Bypass Vulnerability in Joomla

The developers behind Akeeba, an extension for content management systems that lets users backup their work, fixed an outstanding issue this week that could’ve let anyone download site backups, passwords and user lists. Because of the sheer difficulty it takes to exploit the bug, the vulnerabilit...

MeshCMS 3.5 - Remote Code Execution Exploit

No description provided by source. !/usr/bin/python MeshCMS v3.5 remote code execution exploit Environment: Tomcat 7.02/ubuntu 10.04 1 details: There is a add member/editor/admin CSRF vulnerability in this CMS which is very clean for an attacker. The admin will not be told a user has been added a...

osCSS 1.2.1 - Database Backups Disclosure

No description provided by source...

GetSimple CMS 2.01 - Multiple Vulnerabilities (XSS/CSRF)

No description provided by source. !--- Title: GetSimple CMS 2.01 Multiple Vulnerabilities XSS/CSRF Author: 10n1z3d 10n1z3datwdotcn Date: Mon 12 Jul 2010 12:11:45 PM EEST Vendor: http://get-simple.info/ Download: http://www.box.net/get-simple --- -= CSRF PoC 1 - Change Admin Password =- html head...

Cyber Attack On 'Code Spaces' Puts Hosting Service Out of Business

Code Spaces, a code-hosting and software collaboration platform used by different organizations for project management and development needs, was forced to shut down operations after an attacker compromised its internal system and deleted its customer’s data and backups as well. This is really a...

Please make sure you have offline backups

This ransomware has hit not only personal computers, but also organizations, including a town in New Hampshire. This particular attack was carried out when an employee opened a seemingly legitimate email attachment, once again reminding us of the ever-present danger of social engineering...

RIG Exploit Kit Pushing Cryptowall Ransomware

With Cryptolocker quite possibly on its way to becoming yesterday’s ransomware news after the successful takedown of part of its distribution infrastructure, alternatives are already available. Cryptowall is the latest to grab some attention and traction on victimized computers. Cisco reported on...