Magento Server MAGMI Plugin 0.7.17a - Remote File Inclusion

Magento Server MAGMI Plugin 0.7.17a - Remote File Inclusion Exploit found date: 10/24/2014 Security Researcher name: Parvinder Bhasin Contact info: [email protected] twitter: @parvinderb - scorpio Currently tested version: Magento version: Magento CE - 1.8 older MAGMI version: v0.7.17a...

Magento Server MAGMI Plugin 0.7.17a - Remote File Inclusion

Exploit found date: 10/24/2014 Security Researcher name: Parvinder Bhasin Contact info: [email protected] twitter: @parvinderb - scorpio Currently tested version: Magento version: Magento CE - 1.8 older MAGMI version: v0.7.17a older Download software link: Magento server:...

CVE-2012-5242

Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the name parameter in a gettemplate action...

Xxe

The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related to an XML Externa...

CVE-2014-8316: Undefined Security Weakness

XML External Entity XXE vulnerability in polestarxml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 allows remote attackers to read arbitrary files via the xmlParameter parameter in an explorationSpaceUpdate request...

PT-2014-6182 · Bmc · Bmc Track-It!

Name of the Vulnerable Software and Affected Versions: BMC Track-It! version 11.3.0.355 Description: The issue allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information without requiring authentication on TCP port 9010...

CVE-2014-3641

The 1 GlusterFS and 2 Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header...

OpenSSH 6.6 SFTP (x64) - Command Execution

OpenSSH 6.6 SFTP x64 - Command Execution define GNUSOURCE // THIS PROGRAM IS NOT DESIGNED TO BE SAFE AGAINST VICTIM MACHINES THAT // TRY TO ATTACK BACK, THE CODE IS SLOPPY! // In other words, please don't use this against other people's machines. include include include include include include...

OpenSSH < 6.6 SFTP (x64) - Command Execution

define GNUSOURCE // THIS PROGRAM IS NOT DESIGNED TO BE SAFE AGAINST VICTIM MACHINES THAT // TRY TO ATTACK BACK, THE CODE IS SLOPPY! // In other words, please don't use this against other people's machines. include include include include include include include include include define mina,b ab?a:...

WordPress Plugin Creative Contact Form 0.9.7 - Arbitrary File Upload

========================================================== "Creative Contact Form - The Best WordPress Contact Form Builder" - Arbitrary File Upload Author: Gianni Angelozzi Date: 08/10/2014 Remote: Yes Vendor Homepage: https://profiles.wordpress.org/creative-solutions-1/ Software Link:...

CVE-2014-6433

CVE-2014-6433 concerns gpExec in the GoPro HERO 3+. The vulnerability arises from insufficient parameter validation for the a1/a2 parameters when the start action is invoked (c1/c2 set to start), enabling remote code execution. The primary publicly referenced detail is the ZDI advisory (ZDI-14-34...

HttpCombiner ASP.NET - Remote File Disclosure

Exploit Title: HttpCombiner ASP.NET Remote File Disclosure Vulnerability Google Dork: filetype:txt intext:HttpCombiner.ashx Date: 2014-10-10 Exploit Author: Hoang Anh Thai Vendor Homepage: https://myfirstsamplepagebyilyasforassign.googlecode.com/files/HttpCombiner-v1.zip Reference:...

Joomla Re-Issues Security Update After Patches Glitch

Users of the Joomla content management system have been on a patching roller coaster the past 24 hours with one set of patches for critical vulnerabilities being pulled last night before being re-issued today. The Joomla update, bringing the CMS up to version 3.3.6, is a security update addressin...

Joomla! -- Core - Remote File Execution/Denial of Service vulnerabilities

The JSST and the Joomla! Security Center report: 20140903 - Core - Remote File Inclusion Inadequate checking allowed the potential for remote files to be executed. 20140904 - Core - Denial of Service Inadequate checking allowed the potential for a denial of service attack...

Zingiri Web Shop 2.2.0 - init.inc wpabspath Parameter Remote File Inclusion

The zingiri-web-shop WordPress plugin was affected by an init.inc wpabspath Parameter Remote File Inclusion security vulnerability...

UBUNTU-CVE-2014-7169

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the...

[20140903] - Core - Remote File Inclusion

Inadequate checking allowed the potential for remote files to be executed...

Teiid: XML eXternal Entity (XXE) flaw in SQL/XML parsing

It was found that Teiid SQL/XML permitted XML eXternal Entity XXE attacks. If a REST endpoint was deployed, a remote attacker could submit a request containing an external XML entity that, when resolved, allowed that attacker to read files on the application server in the context of the user...

Ecava IntegraXor < 4.2.4458 Multiple Vulnerabilities

Binary data 8400.prm...

Railo Remote File Include

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...