WordPress Sell Downloads Plugin <= 1.0.1 - Arbitrary File Disclosure

Because of this vulnerability, attackers can download arbitrary files from site, under the context of the web server. Solution Upgrade the plugin...

CVE-2014-8877

The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP createfunction...

CVE-2014-8877

The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP createfunction...

CVE-2014-8877

CM Downloads Manager for WordPress (CreativeMinds) contains a remote PHP code execution vulnerability (CVE-2014-8877) in the alterSearchQuery function of lib/controllers/CmdownloadController.php. The issue allows an attacker to inject PHP code via the CMDsearch parameter sent to cmdownloads/, whe...

CVE-2014-9129

CM Download Manager (WordPress) before version 2.0.7 is affected by CVE-2014-9129: a CSRF vulnerability allows authenticated admins to be hijacked and stored XSS via the addons_title field on the CMDM_admin_settings page (POST to wp-admin/admin.php). Root cause: insufficient validation/CSRF prote...

PT-2014-8745

Name of the Vulnerable Software and Affected Versions CM Downloads Manager plugin versions prior to 2.0.4 Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the CMDsearch parameter to the "cmdownloads/" endpoint, which is processed by the PHP create...

PT-2014-8839 · Creative Mind · Cm Download Manager

Name of the Vulnerable Software and Affected Versions: CreativeMinds CM Downloads Manager plugin versions prior to 2.0.7 Description: A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS...

CVE-2014-8877: Improper Control of Generation of Code

The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP createfunction...

CVE-2014-9129: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the addonstitle parameter in the...

Critical Remote Code Execution Flaw Found in WordPress Plugin

There is an easily exploitable remote code execution vulnerability in a popular WordPress plugin that helps manage file downloads and researchers say the bug could be used by even a low-level attacker to run arbitrary code on a vulnerable site. The vulnerability is in the WP Download Manager,...

Joomla! Component com_hdflvplayer 2.1.0.1 - Arbitrary File Download

Joomla! Component comhdflvplayer 2.1.0.1 - Arbitrary File Download !/usr/bin/env python Exploit Title : Joomla HD FLV 2.1.0.1 and below Arbitrary File Download Vulnerability Exploit Author : Claudio Viviani Vendor Homepage : http://www.hdflvplayer.net/ Software Link :...

ESA-2014-135: RSA® Web Threat Detection SQL Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-135: RSA® Web Threat Detection SQL Injection Vulnerability EMC Identifier: ESA-2014-135 CVE Identifier: CVE-2014-4627 Severity Rating: CVSS v2 Base Score: 9 AV:N/AC:L/Au:S/C:C/I:C/A:C Affected Products: RSA Web Threat Detection 4.x versions...

PT-2014-7067

Name of the Vulnerable Software and Affected Versions IBM Tivoli Application Dependency Discovery Manager TADDM versions 7.2.0.0 through 7.2.0.10 IBM Tivoli Application Dependency Discovery Manager TADDM versions 7.2.1.0 through 7.2.1.6 IBM Tivoli Application Dependency Discovery Manager TADDM...

SOL15748 - BIND vulnerability CVE-2010-0290

Recommended action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custo...

Researchers Finds Malicious Tor Exit Node Adding Malware to Binaries

A security researcher has identified a Tor exit node that was actively patching binaries users download, adding malware to the files dynamically. The discovery, experts say, highlights the danger of trusting files downloaded from unknown sources and the potential for attackers to abuse the trust...

Malicious Ads on Yahoo, AOL, Trigger CryptoWall Infections

Attackers have been leveraging the FlashPack Exploit Kit to peddle the CryptoWall 2.0 ransomware on unsuspecting visitors to sites such as Yahoo, The Atlantic and AOL. Researchers believe that for about a month the malvertising campaign hit up to 3 million visitors and netted the attackers $25,00...

APPLE-SA-2014-10-16-2 Security Update 2014-005

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-10-16-2 Security Update 2014-005 Security Update 2014-005 is now available and addresses the following: Secure Transport Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5 Impact: An attacker may be able to decrypt data...

TeamSpeak Client 3.0.14 Buffer Overflow

Title : TeamSpeak Client v3.0.14 - Buffer Overflow Vulnerability Severity : High+/Critical Reporters : SpyEye & Christian Galeone Software Version : 3.0.14 & Previous Versions Software Name : TeamSpeak Client Software Download Link :...

PT-2014-6910

Name of the Vulnerable Software and Affected Versions The 10000 Kindle Books Downloads application version 0.312 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CVE-2014-5925: Undefined Security Weakness

The 10000 Kindle Books Downloads aka com.ww10000KindleBooksLatestnBestSellers application 0.312 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...