CVE-2015-5482: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a .. dot dot in the tab parameter in the gdbbpressattachments page to wp-admin/edit.php...

CVE-2014-8606: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. dot dot in the file parameter in a jsonreturn action in the xclonershow page to wp-admin/admin-ajax.php...

CVE-2015-2994: Undefined Security Weakness

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/userphoto/...

Aruba Networks CPPM Directory Traversal Vulnerability (CNVD-2015-03506)

Aruba Networks ClearPass Policy Manager is an advanced policy management platform for role- and device-based network access control. A directory traversal security vulnerability exists in Aruba Networks ClearPass Policy Manager CPPM, which can be exploited by a remote administrator to execute...

Aruba Networks CPPM Directory Traversal Vulnerability (CNVD-2015-03507)

Aruba Networks ClearPass Policy Manager is an advanced policy management platform for role- and device-based network access control. A directory traversal security vulnerability exists in Aruba Networks ClearPass Policy Manager CPPM, which can be exploited by a remote administrator to execute...

CVE-2015-1551: Undefined Security Weakness

Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager CPPM before 6.4.4 allows remote administrators to read arbitrary files via unspecified vectors...

CVE-2015-4132: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allow remote administrators to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-1392: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allow remote administrators to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-1550: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allows remote administrators to execute arbitrary files via unspecified vectors...

CVE-2014-6628: Undefined Security Weakness

Aruba Networks ClearPass Policy Manager CPPM before 6.5.0 allows remote administrators to execute arbitrary code via unspecified vectors...

CVE-2015-3301: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. dot dot in the tcpboxpath parameter in the checkouteditorsettings page to...

CVE-2015-3345: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the PHPlist Integration Module before 6.x-1.7 for Drupal allows remote administrators to execute arbitrary SQL commands via unspecified vectors, related to the "phpList database."...

CVE-2015-3293: Exposure of Sensitive Information to an Unauthorized Actor

FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command...

CVE-2014-9712: Exposure of Sensitive Information to an Unauthorized Actor

Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allow remote administrators to read arbitrary files and obtain passwords via a crafted path...

CVE-2015-2183: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the administrative backend in ZeusCart 4 allow remote administrators to execute arbitrary SQL commands via the id parameter in a 1 disporders detail or 2 subadminmgt edit action or 3 cid parameter in an editcurrency action to admin/...

CVE-2015-1434: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the 1 letter parameter in a user action or 2 editcategory parameter to index.php...

CVE-2015-1423

Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the 1 jakdeletelog or 2 ssp parameter to admin/index.php...

CVE-2015-1423: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the 1 jakdeletelog or 2 ssp parameter to admin/index.php...

CVE-2015-1371: Improper Input Validation

Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in custom/uploads/...

CVE-2014-9573: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in manageuserpage.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTISMANAGEUSERSCOOKIE cookie...