Folder Plus 2.5.1 Script Injection

Document Title: =============== Folder Plus v2.5.1 iOS - Persistent Item Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1348 Release Date: ============= 2014-10-24 Vulnerability Laboratory ID VL-ID: ==================================== 134...

Folder Plus 2.5.1 iOS - Persistent Cross-Site Scripting

Document Title: =============== Folder Plus v2.5.1 iOS - Persistent Item Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1348 Release Date: ============= 2014-10-24 Vulnerability Laboratory ID VL-ID: ==================================== 134...

ManageEngine Multiple Products multipartRequest Directory Traversal (CVE-2014-6036)

A directory traversal vulnerability exists in ManageEngine OpManager, Social IT Plus and IT360. The vulnerability is due to lack of authentication and insufficient input validation on parameters sent to "/servlets/multipartRequest" in HTTP requests. A remote unauthenticated attacker can delete...

ManageEngine Multiple Products FileCollector Directory Traversal (CVE-2014-6035)

A directory traversal vulnerability exists in ManageEngine OpManager, Social IT Plus and IT360. The vulnerability is due to lack of authentication and insufficient input validation in HTTP requests. A remote unauthenticated attacker can upload arbitrary files to arbitrary locations...

ManageEngine Multiple Products FileCollector doPost Directory Traversal (CVE-2014-6034)

A directory traversal vulnerability exists in ManageEngine OpManager, Social IT Plus and IT360. The vulnerability is due to lack of authentication and insufficient input validation on parameters sent to "/servlet/com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector" in HTTP requests...

ManageEngine OpManager / Social IT Arbitrary File Upload Exploit

Exploit for java platform in category remote exploits Multiple vulnerabilities in ManageEngine OpManager, Social IT Plus and IT360 Discovered by Pedro Ribeiro email protected, Agile Information Security ========================================================================== Background on the...

ManageEngine Code Execution / File Deletion

Hi, This is the fifth part of the ManageOwnage series. For previous parts, see: http://seclists.org/fulldisclosure/2014/Aug/55 http://seclists.org/fulldisclosure/2014/Aug/75 http://seclists.org/fulldisclosure/2014/Aug/88 http://seclists.org/fulldisclosure/2014/Sep/1 This time we have a file uploa...

WP Photo Album Plus 5.4.4 & 5.4.3 Cross-Site Scripting (XSS)

The WP Photo Album Plus WordPress plugin was affected by security vulnerability...

CVE-2014-6723

The Comics Plus aka com.iversecomics.comicsplus.android application 1.06 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Comics Plus aka com.iversecomics.comicsplus.android application 1.06 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6723

CVE-2014-6723 affects the Comics Plus Android app (version 1.06). The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The connected sources provide ...

CVE-2014-6723

The Comics Plus aka com.iversecomics.comicsplus.android application 1.06 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

jigbrowser+ for iOS same origin policy bypass

Overview jigbrowser+ for iOS contains a flaw in loading web pages, which may allow an attacker to bypass the same origin policy. Toshiharu Sugiyama of DeNA Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

WordPress 0day - Hades Plus Framework Add Administrator

Exploit for php platform in category web applications Exploit Title : WordPress 0day - Hades Plus Framework Add Administrator Exploit Author : NULLPointer Date : 18/09/2014 Version: 6.2 Tested on : Linux, Windows 7 -------------------------------------------------------------- WordPress Hades...

WordPress Photo Album Plus 5.4.4 Cross Site Scripting

WP Photo Album Plus Security Vulnerabilities Author: Milhouse Download: https://wordpress.org/plugins/wp-photo-album-plus/ Home Page: http://wppa.opajaap.nl/ Google dork: inurl:wp-content/plugins/wp-photo-album-plus Set up: Wordpress Version: 3.9.1, 3.9.2 WP Photo Album Plus version: 5.4.4, 5.4.3...

Wordpress Support Plus Responsive Ticket System 2.0 Plugin - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Wordpress WP Support Plus Responsive Ticket System 2.0 Plugin - Multiple Vulnerabilities Google Dork: N/A Date: 09.09.2014 Exploit Author: Fikri Fadzil - email protected Vendor Homepage - http://wpsuportplus.byethost7.com/...

CVE-2014-4864

The NETGEAR ProSafe Plus Configuration Utility creates configuration backup files containing cleartext passwords, which might allow remote attackers to obtain sensitive information by reading a file...

MGASA-2014-0374 Updated gtk+3.0 packages fix CVE-2014-1949

Updated gtk+3.0 packages fix security vulnerability: Clemens Fries reported that, when using Cinnamon, it was possible to bypass the screensaver lock. An attacker with physical access to the machine could use this flaw to take over the locked desktop session CVE-2014-1949. This was fixed by...

WordPress WP Support Plus Responsive Ticket System Plugin 2.0 - Multiple Vulnerabilities

There are 4 multiple vulnerabilities in this plugin. 1. SQL injection. 2. Full path disclosure. With this vulnerability full path to the file will be shown to the user after the file has been uploaded. 3. Directory traversal that allows download any file from the server. 4. Broken authentication...

Sql injection

Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus allow remote attackers to execute arbitrary SQL commands via the 1 siteid or 2 url parameter...