IBM Business Process Manager and WebSphere Lombardi Edition Directory Traversal Vulnerability

IBM Business Process Manager BPM is a comprehensive set of business process management platforms from IBM in the U.S. It provides a range of tools related to business process modeling, assembly, monitoring, and deployment.WebSphere Lombardi Edition WLE is the predecessor of the BPM product. A...

osCommerce Japanese Directory Traversal Vulnerability

osCommerce Japanese is a GNUGPL license based on the Japanese version of the open source online shopping e-commerce solution . A directory traversal vulnerability exists in osCommerce Japanese 2.2ms1j-R8 and earlier versions. A remote attacker can exploit this vulnerability to read arbitrary file...

DeDeCMS 5.7-sp1 - Remote File Inclusion

DeDeCMS 5.7-sp1 - Remote File Inclusion ========================== Exploit Title: Dedecms variable coverage leads to getshell Date: 26-06-2015 Vendor Homepage: http://www.dedecms.com/ Version: dedecms 5.7-sp1 and all old version CVE : CVE-2015-4553 =========================== CVE-2015-4553Dedecms...

DeDeCMS < 5.7-sp1 - Remote File Inclusion

========================== Exploit Title: Dedecms variable coverage leads to getshell Date: 26-06-2015 Vendor Homepage: http://www.dedecms.com/ Version: dedecms 5.7-sp1 and all old version CVE : CVE-2015-4553 =========================== CVE-2015-4553Dedecms variable coverage leads to getshell...

WordPress Plugin Paypal Currency Converter Basic For WooCommerce Absolute Path Traversal Vulnerability

WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on PHP and MySQL servers.Paypal Currency Converter Basic For WooCommerce is one of the plugins that supports using Paypal payments in the WooCommerc...

CVE-2015-1851

OpenStack Cinder contains a vulnerability (CVE-2015-1851) where remote authenticated users could read arbitrary files via a crafted qcow2 header in the upload-to-image command. Affected series include OpenStack Cinder releases up to 2014.1.5 (icehouse), 2014.2.x up to 2014.2.4 (juno), and 2015.1....

CVE-2015-5068

XML external entity XXE vulnerability in SAP Mobile Platform 3 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML request, aka SAP Security Note 2159601...

CVE-2015-5065: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl parameter...

Linux/x86 - Download & Execute

Linux/x86 - Download & Execute. Shellcode exploit for linx86 platform Linux/x86 Download&Execute ------WE ARE BOMBERMANS---- Greetz : BombermanLeader Author : B3mB4m Just the two of us LOL. Info! This shellcode has two part.Because when using fork in asm, ocurrs problems in shellcode. So you can...

CVE-2015-4726

PHP remote file inclusion vulnerability in ajax/myajaxphp.php in AudioShare 2.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the config'basedir' parameter...

CVE-2015-4726

AudioShare 2.0.2 is affected by a PHP remote file inclusion in ajax/myajaxphp.php that allows remote attackers to execute arbitrary PHP code via a URL supplied in the config['basedir'] parameter. Root cause appears to be improper handling of config['basedir'], enabling RFI. Severity from referenc...

UBUNTU-CVE-2015-3412

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the streamresolveincludepath function in ext/standard/streamsfuncs.c, as...

CVE-2015-4726: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in ajax/myajaxphp.php in AudioShare 2.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the config'basedir' parameter...

Audio Share 2.0.2 Cross Site Scripting / Remote File Inclusion Vulnerabilities

Audio Share version 2.0.2 suffers from cross site scripting and remote file inclusion vulnerabilities. | Title : Audio Share v2.0.2 Multi Vulnerability | Author : indoushka | email : email protected | Dork : Powered by AudioShareScript.com | Tested on: windows 8.1 Français V.Pro | Download :...

Audio Share 2.0.2 Cross Site Scripting / Remote File Inclusion

| Title : Audio Share v2.0.2 Multi Vulnerability | Author : indoushka | email : [email protected] | Dork : Powered by AudioShareScript.com | Tested on: windows 8.1 Français V.Pro | Download : http://demo.audiosharescript.com/ ======================================= XSS / HTML Inject :...

USN-2649-1 devscripts vulnerability

It was discovered that the uupdate tool incorrectly handled symlinks. If a user or automated system were tricked into processing specially crafted files, a remote attacker could possibly replace arbitrary files, leading to a privilege escalation...

BloBee vulnerable to arbitrary file creation

Overview BloBee provided by CGI RESCUE is a bulletin board software. BloBee contains a vulnerability that may allow a remote attacker to create arbitrary files CWE-20. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload

WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload Title: Remote file upload vulnerability in aviary-image-editor-add-on-for-gravity-forms v3.0beta Wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-06-07 Download Site:...

WordPress SE HTML5 Album Audio Player Plugin 1.1.0 - Directory Traversal

There is a remote file download vulnerability in this plugin. The file called " downloadaudio.php" does not check the file path. Solution Upgrade the plugin...

WordPress Aviary Image Editor Add On For Gravity Forms Plugin - Beta Shell Upload

The remote file upload vulnerability is in aviary-image-editor-add-on-for-gravity-forms/includes/upload.php. Because of this vulnerability anyone can upload any file to the system. Solution Upgrade the plugin...