CVE-2014-8072

The administration module in OpenMRS 2.1 Standalone Edition allows remote authenticated users to obtain read access via a direct request to /admin...

CVE-2014-2009

The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitive information via a direct request to api/curllog.log...

Unrestricted file upload

Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in wp-content/uploads/slideshow-gallery/...

Unrestricted file upload

Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file and a non-zero length PNG file, then accessing the PHP file via a direct request to it i...

CVE-2014-5377

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request...

Server side request forgery (ssrf)

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request...

CVE-2014-5377

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request...

Imperial Fairytale - Multiple Script Direct Request Path Disclosure

The imperial-fairytale WordPress theme was affected by a Multiple Script Direct Request Path Disclosure security vulnerability...

Feather12 - Multiple Script Direct Request Path Disclosure

The feather12 WordPress theme was affected by a Multiple Script Direct Request Path Disclosure security vulnerability...

Studio Zen - Multiple Script Direct Request Path Disclosure

The studiozen WordPress theme was affected by a Multiple Script Direct Request Path Disclosure security vulnerability...

Paid Memberships Pro 1.4.7 - adminpages/memberslist-csv.php Direct Request Member Personal Information Disclosure

The Paid Memberships Pro WordPress plugin was affected by an adminpages/memberslist-csv.php Direct Request Member Personal Information Disclosure security vulnerability...

Dewplayer <= 1.2 - dewplayer.php Direct Request Path Disclosure Weakness

The dewplayer-flash-mp3-player WordPress plugin was affected by a dewplayer.php Direct Request Path Disclosure Weakness security vulnerability...

Q and A - Multiple Scripts Direct Request Path Disclosure

The q-and-a WordPress plugin was affected by a Multiple Scripts Direct Request Path Disclosure security vulnerability...

Spam Free Plugin 1.9.2 - Multiple Script Direct Request Path Disclosure

The Spam Free WordPress WordPress plugin was affected by a Multiple Script Direct Request Path Disclosure security vulnerability...

AntiVirus 1.0 - uninstall.php Direct Request Path Disclosure

The AntiVirus WordPress plugin was affected by an uninstall.php Direct Request Path Disclosure security vulnerability...

search-&-share 0.9.3 - SearchAndShare.php Direct Request Path Disclosure

The search-and-share WordPress plugin was affected by a SearchAndShare.php Direct Request Path Disclosure security vulnerability...

PT-2014-2868 · D Link · D-Link Dir-505L Shareport Mobile Companion +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-505L SharePort Mobile Companion version 1.01 D-Link DIR-826L Wireless N600 Cloud Router version 1.02 Description: The issue allows remote attackers to bypass authentication via a direct request when an authorized session is active...

CVE-2013-2089

Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data...

CVE-2013-2089

Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data...

CVE-2013-2089

Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data...