CVE-2014-3771

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a 1 request to index.php or 2 "changeuserlanguage" request to sources/main.queries.php...

CVE-2014-3771: Undefined Security Weakness

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a 1 request to index.php or 2 "changeuserlanguage" request to sources/main.queries.php...

CVE-2014-3772: Undefined Security Weakness

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a file that calls the sessionstart function before checking the CPM key, as demonstrated by a request to sources/upload/upload.files.php...

PT-2014-5489

Name of the Vulnerable Software and Affected Versions TeamPass versions prior to 2.1.20 Description The issue allows remote attackers to bypass access restrictions. This can be achieved by sending a request to "index.php" followed by a direct request to a file that calls the session start functio...

PT-2014-5488

Name of the Vulnerable Software and Affected Versions TeamPass versions prior to 2.1.20 Description The issue allows remote attackers to bypass access restrictions. This can be achieved via the language file path in a request to "index.php" or a "change user language" request to...

CVE-2014-5190: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in captcha-secureimage/test/index.php in the SI CAPTCHA Anti-Spam plugin 2.7.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

WP Online Store 1.3.1 - index.php slug Parameter Traversal Local File Inclusion

The wp-online-store WordPress plugin was affected by an index.php slug Parameter Traversal Local File Inclusion security vulnerability...

WooCommerce Predictive Search - index.php rs Parameter XSS

The Predictive Search for WooCommerce WordPress plugin was affected by an index.php rs Parameter XSS security vulnerability...

WP Photo Album Plus - index.php wppa-tag Parameter XSS

The WP Photo Album Plus WordPress plugin was affected by an index.php wppa-tag Parameter XSS security vulnerability...

WP Forum Server 1.6.5 - index.php Multiple Parameter SQL Injection

The WP Forum Server WordPress plugin was affected by an index.php Multiple Parameter SQL Injection security vulnerability...

All-in-One Event Calendar 1.9 - index.php Multiple Parameter SQL Injection

The All-in-One Event Calendar WordPress plugin was affected by an index.php Multiple Parameter SQL Injection security vulnerability...

WordPress Simple Balance Theme <= 2.2.1 - Cross Site Scripting

This vulnerability allows remote attackers to inject arbitrary script or HTML via "index.php" file, "s" parameter. Solution Update the theme...

RSVPMaker 2.5.4 - index.php RSVP Form Multiple Field XSS

The RSVPMaker WordPress plugin was affected by an index.php RSVP Form Multiple Field XSS security vulnerability...

Path traversal

Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname in the phpfile parameter to index.php...

CVE-2014-3546

Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in 1 notes/index.php and 2 user/edit.php, which allows remote attackers to obtain potentially sensitive username and course information via a...

CVE-2014-3546

Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in 1 notes/index.php and 2 user/edit.php, which allows remote attackers to obtain potentially sensitive username and course information via a...

CVE-2014-3552

The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction...

UBUNTU-CVE-2014-5030

CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on 1 index.html, 2 index.class, 3 index.pl, 4 index.php, 5 index.pyc, or 6 index.py...

CVE-2014-3552: Improper Authentication

The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction...

CVE-2014-3546: Undefined Security Weakness

Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in 1 notes/index.php and 2 user/edit.php, which allows remote attackers to obtain potentially sensitive username and course information via a...