10751 matches found
Drupal OSF for Drupal Module Arbitrary File Deletion Vulnerability
Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community. osf for Drupal is one of the middle-tier modules that allows customization tools and data display for internally structured data RDF and related vocabularies ontologies. An arbitrary...
Several Critical Flaws Patched in Drupal Module
There are several critical vulnerabilities in a middleware layer used in Drupal, including both cross-site scripting and cross-site request forgery bugs, that can be exploited remotely. The vulnerabilities are in the Open Semantic Framework, which is a third-party project and not part of the Drup...
OSF for Drupal - Critical - Multiple vulnerabilities - SA-CONTRIB-2015-134
The Open Semantic Framework OSF for Drupal is a middleware layer that allows structured data RDF and associated vocabularies ontologies to "drive" tailored tools and data displays within Drupal. The module is vulnerable to reflected Cross Site Scripting XSS because it did not sufficiently filter...
Seeds acmailer Delete Arbitrary File Vulnerability
acmailer is asp-type mail delivery is different from the mail delivery system that you set up on your website. Seeds acmailer 3.8.18 before the version and 3.9.12 ,Beta before the 3.9.x version of a security vulnerability, remote attackers can be exploited with the help of specially crafted strin...
CVE-2015-2971
CVE-2015-2971 affects Seeds acmailer: directory traversal vulnerability in acmailer prior to 3.8.18 and 3.9.x prior to 3.9.12 Beta. An authenticated remote attacker can delete arbitrary server files via a crafted string. The issue originates from improper file path handling in the affected compon...
WordPress BuddyPress Activity Plus 1.5 CSRF / File Deletion Vulnerabilities
Exploit for php platform in category web applications Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report:...
WordPress Plugin BuddyPress Activity Plus 1.5 - Cross-Site Request Forgery
WordPress Plugin BuddyPress Activity Plus 1.5 - Cross-Site Request Forgery Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report:...
WordPress Plugin BuddyPress Activity Plus 1.5 - Cross-Site Request Forgery
Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report: https://security.dxw.com/advisories/csrf-and-arbitrary-file-deletion-in-buddypress-activity-plus-1-5/ CVE: Awaiting assignment CVSS: 8.5 High;...
acmailer vulnerable to directory traversal
Overview acmailer provided by Seeds Co.,Ltd. contains a directory traversal CWE-22 vulnerability. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An authenticated attacker may delete files on the...
WordPress BuddyPress Activity Plus 1.5 CSRF / File Deletion
Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report: https://security.dxw.com/advisories/csrf-and-arbitrary-file-deletion-in-buddypress-activity-plus-1-5/ CVE: Awaiting assignment CVSS: 8.5 High;...
WordPress Image Export 1.1 Arbitrary File Download
Title: Remote file download vulnerability in Wordpress Plugin image-export v1.1 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-01 Download Site: https://wordpress.org/plugins/image-export Vendor: www.1efthander.com Vendor Notified: 2015-07-05 Vendor Contact: https://twitter.com/1eftHander...
LEMON-S PHP Simple Oekaki BBS Arbitrary File Deletion Vulnerability
LEMON-S PHP Simple Oekaki BBS is a PHP-based electronic bulletin board BBS script. A security vulnerability exists in the index.php script of LEMON-S PHP Simple Oekaki BBS versions prior to 1.21. A remote attacker can exploit the vulnerability to delete arbitrary files with the help of the...
Adobe Reader AdobeARM Denial of Service Vulnerability
This vulnerability allows local attackers to delete files on vulnerable installations of Adobe Reader. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of junction points in AdobeARM.exe. A local attacker running code as a normal user can...
phpSQLiteCMS - Multiple Vulnerabilities
phpSQLiteCMS - Multiple Vulnerabilities Exploit Title: CSRF, Unrestricted File Upload, Privilege escalation & XSS Google Dork: intitle: CSRF, Unrestricted File Upload, Privilege escalation & XSS Date: 2015-07-12 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org Vendor Homepage...
CVE-2015-2970
The vulnerability CVE-2015-2970 affects the LEMON-S PHP Simple Oekaki BBS, specifically versions prior to 1.21. A flaw in index.php allows remote attackers to delete arbitrary files by manipulating the oekakis parameter, due to improper parsing. This is a server-side file deletion issue that coul...
Simple Oekaki BBS vulnerability where arbitrary files may be deleted
Overview Simple Oekaki BBS provided by LEMON-S PHP contains a flaw in parsing the oekakis parameter in index.php, which may allow a remote attacker to delete arbitrary files. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...
JVN#61935381: Simple Oekaki BBS vulnerability where arbitary files may be deleted
Simple Oekaki BBS provided by LEMON-S PHP contains a flaw in parsing the oekakis parameter in index.php, which may allow a remote attacker to delete arbitrary files. Impact A remote attacker may delete arbitrary files on the server. Solution Update the Software Update to the latest version...
Cisco Nexus 7000 Device Local Elevation of Privilege Vulnerability
The Cisco Nexus 7000 Series switches help create the network infrastructure platform needed for next-generation unified array data centers. Multiple elevation of privilege vulnerabilities exist in the Python scripting subsystem on Cisco Nexus 7000 devices configured with multiple VDCs, which can ...
CVE-2015-4379
Cross-site request forgery CSRF vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of certain users for requests that delete files via unspecified vectors...