WordPress Powerplay Gallery plugin file upload vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL server set up a personal blog site.Powerplay Gallery is one of the gallery plug-ins for displaying images. A file upload vulnerability exists in the...

SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2017:1384-1)

This update for java-170-ibm fixes the following issues: Version update to 7.0-10.5 bsc1038505 - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative number ...

SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2017:1386-1)

This update for java-180-ibm fixes the following issues: Version update bsc1038505 : - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative number -...

CVE-2015-5682

upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable...

CVE-2015-5682

The CVE concerns the WordPress Powerplay Gallery plugin, version 3.3, where upload.php allows remote attackers to create arbitrary directories through vectors related to the targetDir parameter. This is a remote, unauthenticated vulnerability that enables directory creation, potentially aiding fu...

CVE-2015-5682

upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable...

CVE-2017-8900

LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass intended AppArmor restrictions and visit the home directories of arbitrary users by establishing a guest session...

USN-3285-1: LightDM vulnerability

Tyler Hicks discovered that LightDM did not confine the user session for guest users. An attacker with physical access could use this issue to access files and other resources that they should not be able to access. In the default installation, this includes files in the home directories of other...

Ubuntu 16.10 / 17.04 : lightdm vulnerability (USN-3285-1)

Tyler Hicks discovered that LightDM did not confine the user session for guest users. An attacker with physical access could use this issue to access files and other resources that they should not be able to access. In the default installation, this includes files in the home directories of other...

CVE-2017-8900

LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass intended AppArmor restrictions and visit the home directories of arbitrary users by establishing a guest session...

Delightful Downloads <= 1.6.6 - Unauthenticated Path Traversal

Since no authentication or authorisation checks for direct access to the jqueryFileTree.php are made, the vulnerability allows for browsing the file system on a host out of an unauthenticated context. Even though no file content can be exfiltrated this way, "hidden" files e.g. in the web...

OpenJDK: untrusted extension directories search path in Launcher (JCE, 8163528)

An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges...

OpenJDK: untrusted extension directories search path in Launcher (JCE, 8163528)

An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges...

I_ Librarian 4.6/4.7 - Command Injection / Server Side Request Forgery / Directory Enumeration / Cross-Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: I, Librarian PDF manager vulnerable version: =4.6 & 4.7 fixed version: 4.8 CVE number: - impact: Critical homepage:...

Medium: java-1.8.0-openjdk

Issue Overview: Improper re-use of NTLM authenticated connections Networking, 8163520: It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could...

MODX Revolution Directory Traversal Vulnerability (CNVD-2017-06899)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A directory traversal vulnerability exists in MODX Revolution version 2.5.7. The vulnerability arises du...

[SECURITY] Fedora 25 Update: backintime-1.1.20-1.fc25

Back In Time is a simple backup system for Linux inspired from flyback project and TimeVault. The backup is done by taking snapshots of a specified set of directories...

[SECURITY] Fedora 26 Update: backintime-1.1.20-1.fc26

Back In Time is a simple backup system for Linux inspired from flyback project and TimeVault. The backup is done by taking snapshots of a specified set of directories...

CVE-2016-4455

The Subscription Manager package aka subscription-manager before 1.17.7-1 for Candlepin uses weak permissions 755 for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories...

Design/Logic Flaw

The Subscription Manager package aka subscription-manager before 1.17.7-1 for Candlepin uses weak permissions 755 for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories...