WAP - Web Application Protection

WAP is a source code static analysis and data mining tool to detect and correct input validation vulnerabilities in web applications written in PHP version 4.0 or higher with a low rate of false positives. WAP detects and corrects the following vulnerabilities: SQL Injection SQLI Cross-site...

Redis File Upload

This module can be used to leverage functionality exposed by Redis to achieve somewhat arbitrary file upload to a file and directory to which the user account running the redis instance has access. It is not totally arbitrary because the exact contents of the file cannot be completely controlled...

CVE-2015-4963

IBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows remote attackers to read or write to arbitrary files via unspecified vectors...

CakePHP 3.1.4, 3.0.15, 2.7.6 and 2.6.12 released

CakePHP 3.1.4, 3.0.15, 2.7.6 and 2.6.12 released The CakePHP core team is happy to announce the immediate availability of CakePHP 3.1.4, 3.0.15, 2.7.6, and 2.6.12. These releases contain security fixes. 3.1.4 and 2.7.6 also contain bugfixes. Security Fixes These releases contain fixes for a Remot...

CVE-2015-5671

Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to bypass intended access restrictions and read arbitrary uploaded files via unspecified vectors...

The vulnerability of the SolarWinds Storage Manager data management software allows a hacker to upload and execute arbitrary files.

The vulnerability of the ProcessFileUpload.jsp component in the SolarWinds Storage Manager data management software exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to remotely upload and execute arbitrary files...

FreeBSD : Joomla! -- Core - Remote File Execution/Denial of Service vulnerabilities (cec4d01a-7ac5-11e5-b35a-002590263bf5)

The JSST and the Joomla! Security Center report : 20140903 - Core - Remote File Inclusion Inadequate checking allowed the potential for remote files to be executed. 20140904 - Core - Denial of Service Inadequate checking allowed the potential for a denial of service attack. %NASLMINLEVEL 70300 C...

TeamSpeak Client 3.0.18.1 RFI / Traversal / Code Execution

Exploit Title: "PwnSpeak" a 0day Exploit for TeamSpeak Client / 0x6FB30B11 my pgp keyid Vendor Homepage: https://www.teamspeak.com/ Application: TeamSpeak 3 Version: TeamSpeak3 Client 3.0.0 - 3.0.18.1 Platforms: Windows, Mac OS X and Linux Exploitation: Remote Risk : Very High ========= The Bug...

TeamSpeak Client 3.0.18.1 - Remote File Inclusion Remote Code Execution

TeamSpeak Client 3.0.18.1 - Remote File Inclusion Remote Code Execution Exploit Title: "PwnSpeak" a 0day Exploit for TeamSpeak Client / 0x6FB30B11 my pgp keyid Vendor Homepage: https://www.teamspeak.com/ Application: TeamSpeak 3 Version: TeamSpeak3 Client 3.0.0 - 3.0.18.1 Platforms: Windows, Mac ...

CloudBees Jenkins CI and LTS Directory Traversal Vulnerability

CloudBees Jenkins CI formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . A directory traversal vulnerability exists in CloudBees Jenkins CI versions prior to 1.600 and LTS versions prior to 1.596.1. A remote attack...

TeamSpeak Client <= 3.0.18.1 - RFI to RCE Exploit

Exploit for windows platform in category remote exploits Exploit Title: "PwnSpeak" a 0day Exploit for TeamSpeak Client / 0x6FB30B11 my pgp keyid Vendor Homepage: https://www.teamspeak.com/ Application: TeamSpeak 3 Version: TeamSpeak3 Client 3.0.0 - 3.0.18.1 Platforms: Windows, Mac OS X and Linux...

TeamSpeak Client 3.0.18.1 - Remote File Inclusion / Remote Code Execution

Exploit Title: "PwnSpeak" a 0day Exploit for TeamSpeak Client / 0x6FB30B11 my pgp keyid Vendor Homepage: https://www.teamspeak.com/ Application: TeamSpeak 3 Version: TeamSpeak3 Client 3.0.0 - 3.0.18.1 Platforms: Windows, Mac OS X and Linux Exploitation: Remote Risk : Very High ========= The Bug...

Gwolle Guestbook <= 1.5.3 - Remote File Inclusion (RFI)

The Gwolle Guestbook WordPress plugin was affected by a Remote File Inclusion RFI security vulnerability...

CVE-2015-6003

Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X 1 user or 2 guest account...

Remote File Inclusion in Gwolle Guestbook WordPress Plugin

High-Tech Bridge Security Research Lab discovered a critical Remote File Inclusion RFI in Gwolle Guestbook WordPress plugin, which can be exploited by non-authenticated attacker to include remote PHP file and execute arbitrary code on the vulnerable system. HTTP GET parameter "abspath" is not bei...

Kirby 2.0.4 - Remote File Upload Vulnerability

Exploit for php platform in category web applications Title : Kirby 2.0.4 - Remote File Upload Vulnerability Name CMS : kirby Version : 2.0.4 Author :ZwX Download : Date : 04/12/2014 ------------------------------------- Description ------------------------------------- The vulnerability is in th...

LANDESK Management Suite Remote File Include Vulnerability

1、产品与型号 LANDesk Management Suite LDMS 7 Base | 8 Base | 8.1 Base | 8.5 Base | 8.6 Base | 8.7 Base, SP1, SP2, SP3, SP4, SP5 | 8.70 Base, .7.1, .7.2 | 8.8 Base | 8.80 Base, .1.1 | 9 .0, .1, .2, .3, .4, .5, .6 2、公布时间：2015-8-18 3、CVE:CVE-2014-5362 4、漏洞类型：远程文件包含 5、漏洞详情： A vulnerability in LANDESK...

PCMan FTP Server Information Disclosure Vulnerability

PCMan FTP Server is FTP server software. A directory traversal vulnerability exists in PCMan FTP Server version 2.0.7, which can be exploited by a remote attacker to read arbitrary files via the RETR command inside the "... /" within the RETR command, this vulnerability can be exploited to read...

Web Reference Database PHP Remote File Inclusion Vulnerability

Web Reference Database aka refbase is a web-based multi-user interface product developed by the refbase community to provide search tools and automatic indexing for scientific literature management. A PHP remote file inclusion vulnerability exists in the install.php script in Web Reference Databa...

AjaXplorer Directory Traversal Vulnerability (CNVD-2015-06474)

AjaXplorer is a web-based remote file manager. The manager supports uploading and downloading files, online file editing, image previewing and more. A directory traversal vulnerability exists in AjaXplorer version 2.0. A remote attacker can exploit this vulnerability to read arbitrary files...