Winamp 5.6.1 - '.m3u8' Remote Buffer Overflow

source: https://www.securityfocus.com/bid/47333/info Winamp is prone to a remote buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. Attackers can execute arbitrary code in the context of the affecte...

WordPress Plugin Spellchecker 3.1 - '/general.php' Local/Remote File Inclusion

source: https://www.securityfocus.com/bid/47317/info The Spellchecker plugin for WordPress is prone to a local file-include vulnerability and a remote file-include vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues may allow an attack...

eForum 1.1 - 'eforum.php' Arbitrary File Upload

source: https://www.securityfocus.com/bid/47309/info eForum is prone to an arbitrary-file-upload vulnerability because the application fails to adequately sanitize user-supplied input. An attacker can exploit this issue to upload arbitrary code and run it in the context of the webserver process...

PrestaShop 1.3.6 - cms.php Remote File Inclusion

PrestaShop 1.3.6 - cms.php Remote File Inclusion source: https://www.securityfocus.com/bid/47264/info PrestaShop is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to compromise the application...

InTerra Blog Machine 1.84 - subject HTML Injection

InTerra Blog Machine 1.84 - subject HTML Injection source: https://www.securityfocus.com/bid/47104/info InTerra Blog Machine is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code ...

BackWPup for WordPress Plugin Remote File Inclusion

The version of the BackWPup for WordPress plugin installed on the remote host does not sanitize input to the 'wpabs' parameter of the 'app/wpxmlexport.php' script before using it in a 'requireonce' call when the 'nonce' parameter is set to a specific value. An attacker can leverage this issue to...

webEdition CMS <= 6.1.0.2 Multiple Vulnerabilities - Active Check

webEdition CMS is prone to multiple HTML injection vulnerabilities and a local file-include vulnerability. Copyright C 2011 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

eXPert PDF Batch Creator 7.0.880.0 - Denial of Service

eXPert PDF Batch Creator 7.0.880.0 - Denial of Service source: https://www.securityfocus.com/bid/47040/info eXPert PDF is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause the application to crash, denying service to legitimate users. eXPert PDF 7.0.880.0 is...

OrangeHRM 2.6.2 - 'jobVacancy.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/47046/info OrangeHRM is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage this issue to execute arbitrary script code in the...

SyndeoCMS <= 2.8.02 Multiple Vulnerabilities - Active Check

SyndeoCMS is prone to multiple cross-site scripting XSS vulnerabilities and an SQL injection SQLi vulnerability because it fails to sufficiently sanitize user-supplied data. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

Family Connections 2.3.2 - subject HTML Injection

Family Connections 2.3.2 - subject HTML Injection source: https://www.securityfocus.com/bid/47037/info Family Connections is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in...

XSS in Oracle default fcgi-bin/echo

Long ago, I wrote about an XSS vulnerability in Oracle fcgi-bin/echo : http://lists.grok.org.uk/pipermail/full-disclosure/2010-October/076794.html http://www.securityfocus.com/archive/1/514181 The issue may now be fixed in the latest versions of Oracle web servers:...

CMS Lokomedia Arbitrary File Download Vulnerability - Active Check

CMS Lokomedia is prone to a vulnerability that lets attackers download arbitrary files. This issue occurs because the application fails to sufficiently sanitize user-supplied input. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and...

PluggedOut Blog 1.9.9 - year Cross-Site Scripting

PluggedOut Blog 1.9.9 - year Cross-Site Scripting source: https://www.securityfocus.com/bid/46962/info PluggedOut Blog is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may...

Snow Hui voting system php version upload vulnerability-vulnerability warning-the black bar safety net

Snow Hui voting system not only has a PHP version, but also ASP and ASP. NET version, it seems that the comparison focus, you can add a voting topic, vote items, delete modify functions, friendly interface. The root directory to upload file imgupload.php file code: ? php requireonce"conn.php";...

Cosmoshop 10.05.00 - Multiple Cross-Site Scripting SQL Injections

Cosmoshop 10.05.00 - Multiple Cross-Site Scripting SQL Injections source: https://www.securityfocus.com/bid/46828/info CosmoShop is prone to multiple cross-site scripting vulnerabilities and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input...

CGI:IRC 'nonjs' Interface Cross Site Scripting Vulnerability

CGI:IRC is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Movie Maker 2.1.4026 - '.avi' Remote Buffer Overflow

source: https://www.securityfocus.com/bid/46835/info Windows Movie Maker is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Successfully exploiting this issue allows attackers to execute arbitrary code i...

WordPress Plugin Inline Gallery 0.3.9 - 'do' Cross-Site Scripting

source: https://www.securityfocus.com/bid/46781/info The Inline Gallery WordPress Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecti...

WS Interactive Automne 4.1 - '/admin/upload-controler.php' Arbitrary File Upload

source: https://www.securityfocus.com/bid/46774/info Automne is prone to an arbitrary-file-upload vulnerability. An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application...