PT-2014-6292

Name of the Vulnerable Software and Affected Versions DirPHP version 1.0 Description The issue allows remote attackers to read arbitrary files by providing a full pathname in the phpfile parameter to the "index.php" endpoint. Recommendations For DirPHP version 1.0, consider restricting access to...

CVE-2014-5115: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname in the phpfile parameter to index.php...

CVE-2014-5108

Cross-site scripting XSS vulnerability in singlepages\downloadfile.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/downloadfile...

CVE-2014-5106

The CVE-2014-5106 entry describes a cross-site scripting (XSS) vulnerability in Invision Power IP.Board (IPB) 3.4.x through 3.4.6. An attacker could inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php. This applies to IPB 3.4.x–3.4.6; no exploitation details...

DirPHP 1.0 Local File Inclusion

Exploit Title: DirPHP - version 1.0 Local File Inclusion Google Dork: intext:DirPHP - version 1.0 - Created & Maintained by Stuart Montgomery Date: 7/26/14 Exploit Author: -Chosen- Contact: [email protected] Version: DirPHP - Version 1.0 Tested on: nix PoC:...

CVE-2014-5110: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in user/help/html/index.php in Fonality trixbox allows remote attackers to inject arbitrary web script or HTML via the idnodo parameter...

CVE-2014-5112: Improper Control of Generation of Code

maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter...

PT-2014-6283

Name of the Vulnerable Software and Affected Versions Invision Power IP.Board versions 3.4.x through 3.4.6 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to the...

PT-2014-6285

Name of the Vulnerable Software and Affected Versions concrete5 versions prior to 5.6.3 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download...

PT-2014-6289

Name of the Vulnerable Software and Affected Versions Fonality trixbox affected versions not specified Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter in the maint/modules/home/index.php file. Recommendations At the moment...

CVE-2014-5106: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Invision Power IP.Board aka IPB or Power Board 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php...

CVE-2014-5108: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in singlepages\downloadfile.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/downloadfile...

CVE-2014-5018

Incomplete blacklist vulnerability in the autoEscape function in commonhelper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting XSS attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume...

PT-2014-6231

Name of the Vulnerable Software and Affected Versions Joomla! Youtube Gallery com youtubegallery component versions 3.x and 4.x through 4.1.7 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the listid or themeid parameter to "index.php"...

PT-2014-6250

Name of the Vulnerable Software and Affected Versions LimeSurvey versions 2.05 and later Description The issue is related to an incomplete blacklist vulnerability in the autoEscape function. This allows remote attackers to conduct cross-site scripting XSS attacks via the GBK charset in the loadna...

CVE-2014-5018: Undefined Security Weakness

Incomplete blacklist vulnerability in the autoEscape function in commonhelper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting XSS attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume...

Fonality trixbox - index.php Directory Traversal

Fonality trixbox - index.php Directory Traversal source: https://www.securityfocus.com/bid/68719/info ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these...

CVE-2014-3992

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 entity parameter in an update action to user/fiche.php or 2 sortorder parameter to user/group/index.php...

CVE-2014-3991

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dolusejmobile, 2 doloptimizesmallscreen, 3 dolnomousehover, 4 dolhidetopmenu, 5 dolhideleftmenu, 6 mainmenu, or 7 leftmenu parameter to index.php; th...

CVE-2014-3992

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 entity parameter in an update action to user/fiche.php or 2 sortorder parameter to user/group/index.php...