PT-2015-4190

Name of the Vulnerable Software and Affected Versions Lexmark Markvision Enterprise affected versions not specified Description The issue allows remote authenticated users to write to and execute arbitrary files via a .. dot dot in a file path in a ZIP archive. This is due to a directory traversa...

PT-2015-4284

Name of the Vulnerable Software and Affected Versions FluxBB versions prior to 1.5.8 Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the install lang parameter in the install.php file. Recommendations For versions prior to 1.5.8, upda...

ferretCMS 1.0.4-alpha Cross Site Scripting / SQL Injection

Advisory: Advisory ID: SROEADV-2015-10 Author: Steffen Rösemann Affected Software: ferretCMS v. 1.0.4-alpha Vendor URL: https://github.com/JRogaishio/ferretCMS Vendor Status: vendor will patch eventually CVE-ID: - Tested on: - Firefox 35, Iceweasel 31 - Mac OS X 10.10, Kali Linux 1.0.9a...

PT-2015-3488

Name of the Vulnerable Software and Affected Versions Easewe FTP OCX version 4.5.0.9 Description The issue concerns the EaseWeFtp.FtpLibrary ActiveX control, which does not properly restrict access to certain methods. This allows remote attackers to execute arbitrary files via the Execute or Run...

CVE-2011-5292: Undefined Security Weakness

The EaseWeFtp.FtpLibrary ActiveX control in EaseWeFtp.ocx in Easewe FTP OCX 4.5.0.9 does not restrict access to certain methods, which allows remote attackers to execute arbitrary files via a pathname in the first argument to the 1 Execute or 2 Run method, 3 write to arbitrary files via a pathnam...

Osclass 3.4.2 Shell Upload

--------------------------------------------------------------------- Osclass redirectTo osccontacturl ; 107. 108. 109. if !moveuploadedfile$tmpName, $path 110. unset$path; 111. 112. 113. The vulnerability exists because of the "CWebContact::doModel" method not properly verifying the extension of...

PT-2014-8318

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions 8 build 88xx through 11.4 IT360 versions 10.3 and 10.4 Social IT Plus version 11.0 Description The issue allows remote attackers or remote authenticated users to write and execute arbitrary files. This can be...

ProjectSend Arbitrary File Upload

This module exploits a file upload vulnerability in ProjectSend revisions 100 to 561. The 'process-upload.php' file allows unauthenticated users to upload PHP files resulting in remote code execution as the web server user. Module Options msf use exploit/unix/webapp/projectsend/uploadexec msf...

CVE-2012-5242: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the name parameter in a gettemplate action...

PT-2014-2302

Name of the Vulnerable Software and Affected Versions Banana Dance versions B.2.6 and earlier Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the name parameter in a "get template" action. This is a directory traversal vulnerability i...

Microsoft .NET Framework 'iriParsing' Remote Code Execution Vulnerability

Description Microsoft .NET Framework is prone to a remote code-execution vulnerability. Successfully exploiting this issue may allow attackers to execute arbitrary code in the context of the application. Failed exploit attempts will result in denial-of-service conditions. Technologies Affected...

CVE-2014-6433

CVE-2014-6433 concerns gpExec in the GoPro HERO 3+. The vulnerability arises from insufficient parameter validation for the a1/a2 parameters when the start action is invoked (c1/c2 set to start), enabling remote code execution. The primary publicly referenced detail is the ZDI advisory (ZDI-14-34...

CVE-2014-6433: Improper Control of Generation of Code

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary files via a the 1 a1 or 2 a2 parameter in a start action...

PT-2014-7218

Name of the Vulnerable Software and Affected Versions GoPro HERO 3+ affected versions not specified Description The issue allows remote attackers to execute arbitrary files. This is achieved via the a1 or a2 parameter in a start action. No information is provided about the estimated number of...

PT-2014-8761

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.x through 4.0.10.5 phpMyAdmin versions 4.1.x through 4.1.14.6 phpMyAdmin versions 4.2.x through 4.2.11 Description The issue allows remote authenticated users to include and execute arbitrary local files via a crafted...

Joomla! -- Core - Remote File Execution/Denial of Service vulnerabilities

The JSST and the Joomla! Security Center report: 20140903 - Core - Remote File Inclusion Inadequate checking allowed the potential for remote files to be executed. 20140904 - Core - Denial of Service Inadequate checking allowed the potential for a denial of service attack...

TP-Link TL-WR841N TL-WR841ND - Multiple Vulnerabilities

TP-Link TL-WR841N TL-WR841ND - Multiple Vulnerabilities Title: TP-LINK Model No. TL-WR841N / TL-WR841ND - Multiple Vulnerabilities Date: 30.06.14 Vendor: TP-LINK Affected versions: TL-WR841N / TL-WR841ND Tested on: Firmware Version - 3.13.27 Build 121101 Rel.38183n, Hardware Version - WR841N v8...

CVE-2014-4929

Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in a filename, related to index.php...

CVE-2014-4929: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in a filename, related to index.php...

PT-2014-6213

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.17 ownCloud Server versions 6.0.x prior to 6.0.4 Description A directory traversal issue exists in the routing component, allowing remote attackers to include and execute arbitrary local files by using a...