CVE-2014-8761

CVE-2014-8761 affects DokuWiki: inc/template.php allowed access to root namespace, enabling remote access to arbitrary images via the media file details AJAX call. Connected advisories (Mageia MGASA-2014-0438; Mandriva MDVSA-2015:185; Debian DSA-3059-1; OSV entries) confirm multiple vendors relea...

CVE-2014-8761

inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrary images via a media file details ajax call...

Unrestricted file upload

Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP code by leveraging Author privileges to store a file...

N-Media file uploader vulnerability in handling uploaded files

Overview N-Media file uploader is a plugin for WordPress. N-Media file uploader contains a vulnerability CWE-264 in the way it handles uploaded files. As a result, an arbitrary PHP script which is uploaded may be executed. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC...

JVN#87863382: N-Media file uploader vulnerability in handling uploaded files

N-Media file uploader is a plugin for WordPress. N-Media file uploader contains a vulnerability CWE-264 in the way it handles uploaded files. As a result, an arbitrary PHP script which is uploaded may be executed. Impact A user with "Author" privileges and above may execute an arbitrary command o...

N-Media File Uploader < 2.0 Arbitrary File Upload

The Frontend File Manager Plugin WordPress plugin was affected by security vulnerability...

VLC Media Player <= 1.0.6 (.avi) - Media File Crash PoC

No description provided by source. !/usr/bin/python VLC Media Player =1.0.6 Malformed Media File Crash PoC Found By: DrIDE Tested: Windows 7, Ubuntu 9, OSX 10.6.X Download: http://www.videolan.org Notes: Register overwrites seem very unpredictable at best... Greets: Offsec and Corelan Teams...

RealPlayer 7.0/8.0 Media File Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3809/info RealPlayer is a software package distributed and maintained by Real Media. It is available for Microsoft Windows, Unix, and Linux. A problem with the handling of file format may make it possible to remotely cras...

Abyssal Metal Player 2.0.9 - Denial of Service Vulnerability

No description provided by source. Exploit Title: Abyssal Metal Player 2.0.9 DoS Date: 23/08/2010 Author: 41.w4r10r Version: 2.0.9 Tested on : Windows XP SP2 Eng Software Link: http://www.abyssalsoft.com/files/download.php?id=15 !/usr/bin/python Abyssal Metal Player is Media File Player which Pla...

GLSA-201406-28 : Libav: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201406-28 Libav: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Libav. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open a specially...

Ubuntu: Security Advisory (USN-2244-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Persistent XSS in Media File Renamer V1.7.0 wordpress plugin

Title: Persistent XSS in Media File Renamer V1.7.0 wordpress plugin Date: 1/31/2014 Author: Larry W. Cashdollar, @larry0 Vendor: Notified 2/4/2014 CVE: 2014-2040 Download: http://www.meow.fr/media-file-renamer/ Vulnerability: The following functions do not sanitize input before being echoed out: ...

CVE-2014-2040

Multiple cross-site scripting XSS vulnerabilities in the 1 callbackmulticheck, 2 callbackradio, and 3 callbackwysiwygin functions in mfrhclass.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inje...

CVE-2014-2040

Multiple cross-site scripting XSS vulnerabilities in the 1 callbackmulticheck, 2 callbackradio, and 3 callbackwysiwygin functions in mfrhclass.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inje...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the 1 callbackmulticheck, 2 callbackradio, and 3 callbackwysiwygin functions in mfrhclass.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inje...

CVE-2014-2040

CVE-2014-2040 corresponds to multiple stored XSS vulnerabilities in the WordPress Media File Renamer plugin (v1.7.0). The issues affect the plugin’s settings API callbacks (callback_multicheck, callback_radio, callback_wysiwygin) in mfrh_class.settings-api.php, allowing remote authenticated users...

WordPress Media File Renamer 1.7.0 Cross Site Scripting

Title: Persistent XSS in Media File Renamer V1.7.0 wordpress plugin Date: 1/31/2014 Author: Larry W. Cashdollar, @larry0 Vendor: Notified 2/4/2014 CVE: 2014-2040 Download: http://www.meow.fr/media-file-renamer/ Vulnerability: The following functions do not sanitize input before being echoed out: ...

WordPress Media File Renamer插件多个HTML注入漏洞

Bugtraq ID:65715 CVE ID:CVE-2014-2040 WordPress是一种使用PHP语言开发的博客平台，用户可以在支持PHP和MySQL数据库的服务器上架设自己的网志。 WordPress Media File Renamer插件多个脚本不正确过滤用户提交的数据，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 WordPress Media File Renamer V1.7.0 目前没有详细解决方案提供： http://www.meow.fr/media-file-renamer/ If a user...

WordPress Media File Renamer Plugin <= 1.7.0 - Multiple XSS

Because of these vulnerabilities, authenticated users with permissions to add media or edit media can inject arbitrary web script or HTML via unspecified parameters, as demonstrated by the title of an uploaded file. Solution Update the plugin...

GLSA-201310-12 : FFmpeg: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201310-12 FFmpeg: Multiple vulnerabilities Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers and FFmpeg changelogs referenced below for details. Impact : A remote attacker could entice a us...