CVE-2017-6104

Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0...

CVE-2017-6104

Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0...

Design/Logic Flaw

Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0...

CVE-2017-6104

CVE-2017-6104 concerns the WordPress plugin Mobile App Native 3.0, where the file upload endpoint at zen-mobile-app-native/server/images.php accepts uploads without authentication and without validating the file content. The vulnerability allows an attacker to upload arbitrary files (e.g., PHP sh...

CVE-2017-6104

Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0...

WordPress Mobile App Native 3.0 Shell Upload Vulnerability

WordPress Mobile App Native plugin version 3.0 suffers from a remote shell upload vulnerability. Title: Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0 Vulnerability Date: 2017-02-27 Download: https://wordpress.org/plugins/zen-mobile-app-native/ Vendor:...

CVE-2017-5982

Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e encoded dot dot slash in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd...

Mobile App Native <= 3.0 - Remote File Upload

The code in file ./zen-mobile-app-native/server/images.php doesn't require authentication or check that the user is allowed to upload content. It also doesn't sanitize the file upload against executable code. $ curl -F "file=@/var/www/shell.php"...

CVE-2017-6344

XML External Entity XXE vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document...

U.S. Dept Of Defense: Remote file inclusion vulnerability on a DoD website

A misconfigured Department of Defense website may have allowed unauthorized users to remotely download local files, potentially revealing sensitive system or user information. @sp1d3rs was able to demonstrate this vulnerability by crafting a specially formatted URL...

Hawtio Directory Traversal Vulnerability

hawtio is a Web console for managing Java frameworks . A directory traversal vulnerability exists in hawtio due to the program failing to properly filter user-submitted input. A remote attacker can exploit this vulnerability by using directory traversal characters '... /' to access arbitrary file...

CVE-2016-4679

An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "libarchive" component, which allows remote attackers to write to arbitrary files via a crafted...

D-Link ADSL Router DSL-2730U/2750U/2750E - Remote File Disclosure

No description provided by source...

CVE-2017-6055

XML external entity XXE vulnerability in eParakstitajs 3 before 1.3.9 and eParaksts Java lib before 2.5.13 allows remote attackers to read arbitrary files or possibly have unspecified other impact via a crafted edoc file...

Updated nagios packages fix security vulnerabilities

The nagios package has been patched to fix the following issues: Improper sanitization of RSS feed input enables unauthenticated remote read and write of arbitrary files CVE-2016-9565. Unsafe logfile handling allows unprivileged users to escalate their privileges to root CVE-2016-9566...

Code injection

IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file...

CVE-2016-0214

IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file...

CVE-2016-0214

IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file...

CVE-2016-6104

IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, which could allow the attacker to execute arbitrary code on the vulnerable system...

The vulnerability of the Android operating system, which allows a hacker to gain unauthorized access to the device

The vulnerability in the silk/NLSFstabilize.c function of the libopus media server in the Android operating system arises from an operation that goes beyond the buffer boundaries on the stack. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized acce...