Design/Logic Flaw

Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1...

Design/Logic Flaw

Remote file upload vulnerability in mailcwp v1.99 wordpress plugin...

CVE-2015-1000001

Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin...

CVE-2015-1000013

Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1...

CVE-2015-1000001

The CVE-2015-1000001 entry maps to WordPress plugin fast-image-adder (v1.1 and earlier). A Remote File Upload vulnerability exists in the uploader script (fast-image-adder-uploader.php), allowing an unauthenticated attacker to upload arbitrary files to the server (potentially leading to web shell...

CVE-2015-1000013

The csv2wpec-coupon WordPress plugin version v1.1 is vulnerable to an unauthenticated remote file upload vulnerability. The root cause is that the csv2wpecCoupon_FileUpload.php file fails to properly sanitize user input; while it checks for the x-php mime-type, attackers can bypass this check usi...

CVE-2015-1000000

Remote file upload vulnerability in mailcwp v1.99 wordpress plugin...

CVE-2015-1000000

CVE-2015-1000000 affects the MailCWP WordPress plugin (around v1.99/v1.100) via an unauthenticated arbitrary file upload vulnerability. The root cause is improper access control in the upload logic (mailcwp-upload.php), allowing any user to upload a file without authentication or type checks, pot...

CVE-2015-1000001: Unrestricted Upload of File with Dangerous Type

Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin...

CVE-2015-1000000: Unrestricted Upload of File with Dangerous Type

Remote file upload vulnerability in mailcwp v1.99 wordpress plugin...

CVE-2015-1000013: Unrestricted Upload of File with Dangerous Type

Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1...

Picosafe Web GUI - Multiple Vulnerabilities

Picosafe Web GUI - Multiple Vulnerabilities - Title : Picosafe Web Gui - Multiple Vulnerabilities - Author : Shahab Shamsi - Vendor : https://github.com/embeddedprojects/picosafewebgui - Category : Webapps - Date : 01.October.2016 Vulnerable page :...

Picosafe Web GUI - Multiple Vulnerabilities

Title : Picosafe Web Gui - Multiple Vulnerabilities - Author : Shahab Shamsi - Vendor : https://github.com/embeddedprojects/picosafewebgui - Category : Webapps - Date : 01.October.2016 Vulnerable page : picosafewebgui/webinterface/js/filemanager/filemanager.php ========================== | Remote...

EMC ViPR SRM Cross-Site Request Forgery Vulnerability (CNVD-2016-07741)

EMC ViPR SRM is a suite of storage resource management software from EMC Corporation. The software enables intuitive understanding of storage relationships, analyzes configuration and capacity growth and optimizes resources to improve return on investment ROI in storage environments. A cross-site...

WordPress Contus Video Comments 1.0 File Upload

Title: Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2016-06-15 Download Site: https://wordpress.org/plugins/contus-video-comments/ Vendor: https://profiles.wordpress.org/hdflvplayer/ Vendor Notified: 2016-06-16...

Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution', 'Description' = %q This module exploits a remo...

Micro Focus Service Desk Path Traversal Vulnerability

Micro Focus Service Desk formerly Novell Service Desk is a service management solution for monitoring and resolving service issues from Micro Focus in the UK. The solution provides incident management, problem management, service catalog definition and management, financial management, knowledge...

Low: nmap

Issue Overview: The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload arbitrarily named files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences. Affected Packages:...

Zomato: Remote File Upload Vulnerability in business-blog.zomato.com

hi https://business-blog.zomato.com installed an outdated MailPoet Plugin which vulnerable to Remote File Upload Vulnerability in WordPress MailPoet Plugin wysija-newsletters related article: https://blog.sucuri.net/2014/07/remote-file-upload-vulnerability-on-mailpoet-wysija-newsletters.html...

CVE-2015-6407

Cisco Emergency Responder 10.5(3.10000.9) is affected by a Web Framework Arbitrary File Upload vulnerability. The issue stems from insufficient parameter validation in the CER web framework, allowing unauthenticated remote attackers to upload arbitrary files to arbitrary locations on the device v...