Updated owncloud package fixes security vulnerabilities

In ownCloud before 6.0.8 and 8.0.4, a bug in the SDK used to connect ownCloud against the Dropbox server might allow the owner of "Dropbox.com" to gain access to any files on the ownCloud server if an external Dropbox storage was mounted CVE-2015-4715. In ownCloud before 6.0.8 and 8.0.4, the...

Microweber 1.0.3 Shell Upload

Microweber v1.0.3 File Upload Filter Bypass Remote PHP Code Execution Vendor: Microweber Team Product web page: http://www.microweber.com Affected version: 1.0.3 Summary: Microweber is an open source drag and drop PHP/Laravel CMS licensed under Apache License, Version 2.0 which allows you to...

Microweber v1.0.3 File Upload Filter Bypass Remote PHP Code Execution

Summary Microweber is an open source drag and drop PHP/Laravel CMS licensed under Apache License, Version 2.0 which allows you to create your own website, blog or online shop. Description Microweber suffers from an authenticated arbitrary command execution vulnerability. The issue is caused due t...

Command injection when using external SMB storage - ownCloud

The external SMB storage of ownCloud was not properly neutralizing all special elements which allows an adversary to execute arbitrary SMB commands. This was caused by improperly sanitizing the ; character which is interpreted as command separator by smbclient the used software to connect to SMB...

Server: Command injection when using external SMB storage

The external SMB storage of ownCloud was not properly neutralizing all special elements which allows an adversary to execute arbitrary SMB commands. This was caused by improperly sanitizing the ; character which is interpreted as command separator by smbclient the used software to connect to SMB...

PT-2015-6678

Name of the Vulnerable Software and Affected Versions AudioShare version 2.0.2 Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the config'basedir' parameter in the ajax/myajaxphp.php file. Recommendations For AudioShare version 2.0.2, consider restricting...

mt-phpincgi Arbitrary PHP Code Execution Vulnerability

mt-phpincgi is a script that runs Movable Type templates. An arbitrary PHP code execution vulnerability exists in mt-phpincgi, which allows remote attackers to submit a special request to execute arbitrary PHP code in the context of a web process...

CVE-2015-0935

Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts...

CVE-2015-0935

Bomgar Remote Support prior to 15.1.1 is vulnerable to arbitrary PHP code execution via crafted serialized data that is deserialized by the application. The root cause is improper handling of untrusted serialized input (PHP unserialize) in the Bomgar portal, enabling an attacker to execute code i...

PT-2015-5994

Name of the Vulnerable Software and Affected Versions mt-phpincgi.php in Hajime Fujimoto mt-phpincgi versions prior to 2015-05-15 Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request. This has been exploited in...

PT-2015-4983

Name of the Vulnerable Software and Affected Versions Bomgar Remote Support versions prior to 15.1.1 Description The issue allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts. Recommendations For versions prior to 15.1.1, update to version...

CVE-2015-0935: Improper Control of Generation of Code

Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts...

WordPress Wp Image Zoom Plugin <= 1.0.3 - PHP Code Execution

This plugin is prone to download.php file upload PHP code execution vulnerability. Solution Update plugin...

PT-2015-5265

Name of the Vulnerable Software and Affected Versions Magento Community Edition versions 1.9.1.0 Magento Enterprise Edition versions 1.14.1.0 Description The issue allows remote authenticated users to include and execute certain PHP files. This can be achieved via .. dot dot sequences in the PATH...

CVE-2015-1399: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in the fetchView function in the MageCoreBlockTemplateZend class in Magento Community Edition CE 1.9.1.0 and Enterprise Edition EE 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPa...

PT-2015-5266

Name of the Vulnerable Software and Affected Versions Magento Community Edition CE version 1.9.1.0 Magento Enterprise Edition EE version 1.14.1.0 Description A remote file inclusion issue exists in the fetchView function within the Mage Core Block Template Zend class, allowing remote administrato...

Magento Patched Remote Execution Hole in eCommerce Platform

A nasty remote code execution vulnerability was recently patched in eBay’s eCommerce platform Magento. The hole, disclosed Monday, could put upwards to 200,000 company’s web stores, and their customers’ information at risk of being compromised. If exploited, researchers claim the vulnerability...

Arbitrary Variable Overwrite in eShop WordPress Plugin

High-Tech Bridge Security Research Lab discovered security vulnerability in eShop WordPress Plugin, which can be exploited by remote attacker to overwrite arbitrary PHP variables within the context of the vulnerable application. The vulnerability exists due to insufficient validation of...

PT-2015-5643

Name of the Vulnerable Software and Affected Versions Slim versions prior to 2.6.0 Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data in the Middleware/SessionCookie.php file. Recommendations For versions...

Qibo Blog 1.0 /blog/require/ajax/ol_module.php 本地文件包含漏洞

/blog/require/ajax/olmodule.phpif$step==2 $uid=$lfjuid; @include"template/space/module/$moduleid.php"; /ÐÂÔö¼ÓµÄÄ£¿éʹ֮¿ÉÒÔÍÏÀ­/ //$ThisModule$moduleid=strreplace'class="head"','class="head" onMouseOver="Drag.inint;"',$ThisModule$moduleid; if!$ThisModule$moduleid...