Design/Logic Flaw

Cisco FireSIGHT Management Center with software 4.10.3, 5.2.0, 5.3.0, 5.3.1, and 5.4.0 allows remote authenticated users to read arbitrary files via a crafted GET request, aka Bug ID CSCur25410...

WordPress Squirrel Theme 1.6.4 Remote File Inclusion

| Title : WP-squirrel 1.6.4 Theme R/L Files Inclusion Download Vulnerability | Author : indoushka | email : [email protected] | Tested on: windows 8.1 Français V.Pro | Download : https://wordpress.org/themes/squirrel/ ======================================= poc : requireonce $functionspath...

Camel: XXE in via SAXSource expansion

It was found that Apache Camel's XML converter performed XML External Entity XXE expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more...

WordPress Gwolle Guestbook 1.5.3 Remote File Inclusion Vulnerability

WordPress Gwolle Guestbook plugin version 1.5.3 suffers from a remote file inclusion vulnerability. Product: Gwolle Guestbook WordPress Plugin Vendor: Marcel Pol Vulnerable Versions: 1.5.3 and probably prior Tested Version: 1.5.3 Advisory Publication: October 14, 2015 without technical details...

WordPress Gwolle Guestbook Plugin 1.5.3 - Remote File Inclusion

This Gwolle Guestbook plugin is prone to remote file include vulnerability. It allows an attacker to include a remote file and get access to the server, because "abspath"parameter is not sanitized before it will be using in PHP require function and "wp-load.php" file is included on the web server...

WordPress Gwolle Guestbook Plugin 1.5.3 - Remote File Inclusion

This Gwolle Guestbook plugin is prone to remote file include vulnerability. It allows an attacker to include a remote file and get access to the server, because "abspath"parameter is not sanitized before it will be using in PHP require function and "wp-load.php" file is included on the web server...

WordPress Plugin Gwolle Guestbook 1.5.3 - Remote File Inclusion

Advisory ID: HTB23275 Product: Gwolle Guestbook WordPress Plugin Vendor: Marcel Pol Vulnerable Versions: 1.5.3 and probably prior Tested Version: 1.5.3 Advisory Publication: October 14, 2015 without technical details Vendor Notification: October 14, 2015 Vendor Patch: October 16, 2015 Public...

WordPress Plugin Gwolle Guestbook 1.5.3 - Remote File Inclusion

WordPress Plugin Gwolle Guestbook 1.5.3 - Remote File Inclusion Advisory ID: HTB23275 Product: Gwolle Guestbook WordPress Plugin Vendor: Marcel Pol Vulnerable Versions: 1.5.3 and probably prior Tested Version: 1.5.3 Advisory Publication: October 14, 2015 without technical details Vendor...

WordPress Gwolle Guestbook 1.5.3 Remote File Inclusion

Advisory ID: HTB23275 Product: Gwolle Guestbook WordPress Plugin Vendor: Marcel Pol Vulnerable Versions: 1.5.3 and probably prior Tested Version: 1.5.3 Advisory Publication: October 14, 2015 without technical details Vendor Notification: October 14, 2015 Vendor Patch: October 16, 2015 Public...

Gwolle Guestbook WordPress Plugin Remote File Inclusion Vulnerability

Gwolle Guestbook WordPress is a visiting message board plugin for WordPress sites. Gwolle Guestbook WordPress 1.5.3 and earlier versions do not effectively filter the value of the "abspath" HTTP GET parameter, used in the PHP require function, which allows remote attackers to include a file named...

The vulnerability of the Microsoft .NET Framework software platform, which allows a hacker to read arbitrary files

The vulnerability of the XML DTD parser component in the Microsoft .NET Framework is related to the lack of protection for operational data. Exploiting this vulnerability allows an attacker to remotely read arbitrary files by creating external declarations on XXE objects...

The vulnerability of the microprogramming software in Janitza UMG 508, 509, 511, 604, 605 power supply monitoring systems allows a intruder to read or write files.

The vulnerability of the FTP service provided by the microprogramming software for Janitza UMG 508, 509, 511, 604, and 605 control systems is related to the use of a default password. Exploiting this vulnerability allows an attacker to remotely read or write files by establishing a TCP session on...

CVE-2015-7815

Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows remote attackers to include and execute arbitrary local files via the viewDataTable parameter...

AlegroCart 1.2.8 Local / Remote File Inclusion

Security Advisory - Curesec Research Team 1. Introduction Affected Product: AlegroCart 1.2.8 Fixed in: Patch AC128fix22102015 Path Link: http://forum.alegrocart.com/download/file.php?id=1047 Vendor Website: http://alegrocart.com/ Vulnerability Type: LFI/RFI Remote Exploitable: Yes Reported to...

AlegroCart 1.2.8 - Local/Remote File Inclusion

Security Advisory - Curesec Research Team 1. Introduction Affected Product: AlegroCart 1.2.8 Fixed in: Patch AC128fix22102015 Path Link: http://forum.alegrocart.com/download/file.php?id=1047 Vendor Website: http://alegrocart.com/ Vulnerability Type: LFI/RFI Remote Exploitable: Yes Reported to...

AlegroCart 1.2.8 - LocalRemote File Inclusion

AlegroCart 1.2.8 - LocalRemote File Inclusion Security Advisory - Curesec Research Team 1. Introduction Affected Product: AlegroCart 1.2.8 Fixed in: Patch AC128fix22102015 Path Link: http://forum.alegrocart.com/download/file.php?id=1047 Vendor Website: http://alegrocart.com/ Vulnerability Type:...

Microsoft .NET Framework Directory Traversal Vulnerability

Microsoft .NET Framework is a popular software development toolkit. A directory traversal vulnerability in Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2,4.6 allows remote attackers to read arbitrary files by combining entity references with external entity declaratio...

flash-plugin: multiple code execution issues fixed in APSB15-28

Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allow remote attackers to bypass intended access restrictions and writ...

CVE-2015-6096

The XML DTD parser in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka ".NET Information Disclosu...

WAP - Web Application Protection

WAP is a source code static analysis and data mining tool to detect and correct input validation vulnerabilities in web applications written in PHP version 4.0 or higher with a low rate of false positives. WAP detects and corrects the following vulnerabilities: SQL Injection SQLI Cross-site...