64 matches found
CVE-2019-7719
Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request...
Design/Logic Flaw
Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request...
CVE-2019-7719
Nibbleblog 4.0.5 is affected by CVE-2019-7719 via an eval injection flaw. The vulnerability occurs when PHP code is placed in the install.php username parameter and a subsequent request to content/private/shadow.php is made, enabling arbitrary PHP evaluation on the server. The NVD entry lists a h...
CVE-2019-7719
Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request...
CVE-2018-16604
An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes e.g., "$phpinfo"...
CVE-2018-16604
An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes e.g., "$phpinfo"...
Design/Logic Flaw
An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes e.g., "$phpinfo"...
CVE-2018-16604
Nibbleblog v4.0.5 is affected. The issue allows an attacker with admin credentials to execute arbitrary PHP code by exploiting the username field, which is surrounded by double quotes (e.g., "${phpinfo()}"). Root cause is improper handling of the admin username leading to code execution. Impact i...
CVE-2018-16604
An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes e.g., "$phpinfo"...
Nibbleblog Information Disclosure Vulnerability
Nibbleblog for macOS is a set of blogging engine based on macOS platform. A security vulnerability exists in version 4.0.5 of Nibbleblog for macOS. An attacker can exploit the vulnerability to obtain DSStore information...
CVE-2018-6470
Nibbleblog 4.0.5 on macOS defaults to having .DSStore in each directory, causing DSStore information to leak...
Design/Logic Flaw
Nibbleblog 4.0.5 on macOS defaults to having .DSStore in each directory, causing DSStore information to leak...
CVE-2018-6470
Nibbleblog 4.0.5 on macOS defaults to having .DSStore in each directory, causing DSStore information to leak...
CVE-2018-6470
Nibbleblog 4.0.5 on macOS is affected by an information disclosure vulnerability where .DS_Store files are present in each directory, leaking DS_Store metadata. Root cause is the default behavior of placing DS_Store files in directories, enabling partial confidentiality impact (DS_Store data expo...
CVE-2018-6470
Nibbleblog 4.0.5 on macOS defaults to having .DSStore in each directory, causing DSStore information to leak...
Nibbleblog File Upload Vulnerability
Exploit for php platform in category remote exploits This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Nibbleblog File Upload Vulnerability', 'Description' = %q Nibbleblog contai...
Nibbleblog 4.0.3 - Arbitrary File Upload (Metasploit)
This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Nibbleblog File Upload Vulnerability', 'Description' = %q Nibbleblog contains a flaw that allows a authenticated remote attacker...
Nibbleblog File Upload
This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Nibbleblog File Upload Vulnerability', 'Description' = %q Nibbleblog contains a flaw that allows a authenticated remote attacker...
