5449 matches found
CVE-2015-4607: Undefined Security Weakness
Unrestricted file upload vulnerability in the Frontend User Upload feupload extension 0.5.0 and earlier for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension using a frontend form, then accessing it via a direct request to the file in the...
Arbitrary Code Execution in extension Frontend User Upload (feupload)
It has been discovered that the extension "Frontend User Upload" feupload is susceptible to Arbitrary Code Execution Release Date: June 15, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 0.5.0 and below...
N-Media File Uploader <= 3.7 - Arbitrary File Upload
The Frontend File Manager Plugin WordPress plugin was affected by an Arbitrary File Upload security vulnerability...
SUSE SLED12 / SLES12 Security Update : postgresql93 (SUSE-SU-2015:0478-1)
postgresql93 was updated to version 9.3.6 to fix four security issues. These security issues were fixed : - CVE-2015-0241: Fix buffer overruns in tochar bnc916953. - CVE-2015-0243: Fix buffer overruns in contrib/pgcrypto bnc916953. - CVE-2015-0244: Fix possible loss of frontend/backend protocol...
Shopify: Force 500 Internal Server Error on any shop (for one user)
There is very strange behavior. If user open urls like below: - https://whashp.myshopify.com/?previewthemeid=11288717 - or https://lmfshp.myshopify.com/?previewthemeid=11290937 He got redirect to shop https://whashp.myshopify.com/ and 500 Internal Server Error response, and reload does not help i...
Cross-Site Scripting vulnerability in EMC M&R (Watch4net) Alerting Frontend
------------------------------------------------------------------------ Cross-Site Scripting vulnerability in EMC M&R Watch4net Alerting Frontend ------------------------------------------------------------------------ Han Sahin, November 2014...
EMC M&R (Watch4net) Alerting Frontend XSS
------------------------------------------------------------------------ Cross-Site Scripting vulnerability in EMC M&R Watch4net Alerting Frontend ------------------------------------------------------------------------ Han Sahin, November 2014...
OpenKM Cross-Site Scripting Vulnerability
OpenKM is a document management system from OpenKM Spain. The system provides features such as version control, document history and file sharing. A cross-site scripting vulnerability exists in OpenKM version 6.4.18 build 23338, which stems from a frontend/index.jsp script that fails to adequatel...
CVE-2014-9017
Cross-site scripting XSS vulnerability in OpenKM before 6.4.19 build 23338 allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to frontend/index.jsp...
CVE-2014-9017: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in OpenKM before 6.4.19 build 23338 allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to frontend/index.jsp...
Authentication Bypass in TYPO3 CMS 4.5
It has been discovered that TYPO3 CMS 4.5.x is vulnerable to Authentication Bypass. Component Type: TYPO3 CMS Vulnerability Types: Authentication Bypass Overall Severity: Critical Release Date: February 19, 2015 Bulletin Update: February 23, 2015 added CVE Vulnerable subcomponent: rsaauth system...
Important Security-Bulletin Pre-Announcement
A TYPO3 4.5.40 release containing a security fix will be published the day after tomorrow, Thursday 19th of February at about 10:00 am CET. The TYPO3 security team has identified a critical security issue in the TYPO3 v4 Core. The following branches are affected by the vulnerability: TYPO3 4.3...
Cross site scripting
Cross-site scripting XSS vulnerability in the frontend interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2014-100034
Cross-site scripting XSS vulnerability in the frontend interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2014-100034: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the frontend interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Code injection
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via...
CVE-2014-9508
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via...
CVE-2014-9509
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact possibly resource consumption via a "Cache Poisoning" attack using a...
CVE-2014-9509
CVE-2014-9509 affects TYPO3: the frontend rendering component in TYPO3 4.5.x (before 4.5.39), 4.6.x–6.2.x (before 6.2.9), and 7.x (before 7.0.2). When config.prefixLocalAnchors is set to all or cached, remote attackers can trigger a cache-poisoning scenario by crafting a URL with arbitrary argume...
CVE-2014-9508
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via...