Gazou BBS plus vulnerability in file upload processing

Overview Gazou BBS plus provided by LEMON-S PHP contains a vulnerability in the processing of file uploads. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An image file may be specially crafted t...

JVN#86680970: Gazou BBS plus vulnerability in file upload processing

Gazou BBS plus provided by LEMON-S PHP contains a vulnerability in the processing of file uploads. Impact An image file may be specially crafted to upload arbitrary HTML files. Solution Apply an Update Apply the update according to the information provided by the provider. Products Affected Gazou...

ManageEngine Exchange Reporter Plus 4.7 SQL Injection

Arbitrary SQL statement execution in ManageEngine Exchange Reporter Plus RunQuery.jsp Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

WordPress BuddyPress Activity Plus Plugin 1.5 - CSRF

BuddyPress Activity Plus plugin is prone to a cross-site request forgery that allows an attacker to delete any file which PHP process can delete. Solution Upgrade the plugin...

WordPress Plugin BuddyPress Activity Plus 1.5 - Cross-Site Request Forgery

WordPress Plugin BuddyPress Activity Plus 1.5 - Cross-Site Request Forgery Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report:...

WordPress BuddyPress Activity Plus 1.5 CSRF / File Deletion Vulnerabilities

Exploit for php platform in category web applications Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report:...

WordPress Plugin BuddyPress Activity Plus 1.5 - Cross-Site Request Forgery

Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report: https://security.dxw.com/advisories/csrf-and-arbitrary-file-deletion-in-buddypress-activity-plus-1-5/ CVE: Awaiting assignment CVSS: 8.5 High;...

WordPress BuddyPress Activity Plus 1.5 CSRF / File Deletion

Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report: https://security.dxw.com/advisories/csrf-and-arbitrary-file-deletion-in-buddypress-activity-plus-1-5/ CVE: Awaiting assignment CVSS: 8.5 High;...

ZOHO ManageEngine SupportCenter Plus Cross-Site Scripting Vulnerability

ZOHO ManageEngine SupportCenter Plus is a customer service support management software from ZOHO USA. The software provides help desk, customer management, service level management and tracking of customer requests. A cross-site scripting vulnerability exists in ZOHO ManageEngine SupportCenter Pl...

Libcrypt++ Private Key Disclosure Vulnerability

libcrypt is an ANSI C encryption library. A private key disclosure vulnerability exists in libcrypt++, which allows remote attackers to obtain a private key via a timing attack...

ZOHO ManageEngine SupportCenter Plus Directory Traversal Vulnerability

ZOHO ManageEngine SupportCenter Plus is a customer service support management software from ZOHO USA. The software provides help desk, customer management, service level management and tracking of customer requests. A directory traversal vulnerability exists in ZOHO ManageEngine SupportCenter Plu...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the 1 query parameter in the runqueryeditorquery module to CustomReportHandler.do, 2 compAcct parameter to jsp/ResetADPwd.jsp,...

Directory traversal

Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. dot dot in the component parameter in the Request component to workorder/Attachment.jsp...

CVE-2015-5150

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the 1 query parameter in the runqueryeditorquery module to CustomReportHandler.do, 2 compAcct parameter to jsp/ResetADPwd.jsp,...

CVE-2015-5150

The CVE-2015-5150 entry concerns Zoho ManageEngine SupportCenter Plus version 7.90, where three XSS vectors exist: (1) the query parameter in run_query_editor_query via CustomReportHandler.do, (2) the compAcct parameter to jsp/ResetADPwd.jsp, and (3) the redirectTo parameter to jsp/CacheScreenWid...

CVE-2015-5149

Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. dot dot in the component parameter in the Request component to workorder/Attachment.jsp...

CVE-2015-5149

CVE-2015-5149 affects Zoho ManageEngine SupportCenter Plus 7.90. A directory traversal flaw in the workorder/Attachment.jsp path allows remote authenticated users to write arbitrary files by manipulating the component parameter (using .. style traversal). The vulnerability is caused by insufficie...

Explorer+ File Manager vulnerable to directory traversal

Overview Explorer+ File Manager provided by Droidware UK contains an issue in processing file names, which may result in a directory traversal CWE-22 vulnerability. Ryohei Koike of Sakura Information Systems Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer...

ManageEngine SupportCenter Plus Multiple Vulnerabilities (Jun 2015)

ManageEngine SupportCenter Plus is prone to multiple vulnerabilities. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

ManageEngine SupportCenter Plus Detection (HTTP)

HTTP based detection of ManageEngine SupportCenter Plus. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...