Openfire 3.10.2 - Remote File Inclusion

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-RFI.txt Vendor: ================================ www.igniterealtime.org/projects/openfire www.igniterealtime.org/downloads/index.jsp Product: ================================...

Openfire 3.10.2 - Remote File Inclusion

Openfire 3.10.2 - Remote File Inclusion...

SUSE-SU-2015:1637-1 Security update for coreutils

This update for coreutils provides the following fixes: - Fix memory handling error with case insensitive sort using UTF-8. CVE-2015-4041, CVE-2015-4042 - Ensure 'df -a' shows all remote file system entries. - Only suppress remote mounts of separate exports with 'df --total'. - Document that 'df...

Csv2WPeC Coupon <= 1.1 - Unauthenticated Remote File Upload

The code in csv2wpecCouponFileUpload.php does not properly sanitize user input, it checks the file mime-type for type x-php but this can be tricked when using the short code for "; $uploadfile="/var/www/s.pht"; $ch =...

WordPress CsvWPeC Coupon Plugin <= 1.1 - Remote File Upload

This plugin is prone to a remote file upload vulnerability, because user input is not properly sanitized. It allows a malicious user to upload executable files to a vulnerable wordpress installation. Solution Update the plugin...

Csv2WPeC Coupon <= 1.1 - Unauthenticated Remote File Upload

The code in csv2wpecCouponFileUpload.php does not properly sanitize user input, it checks the file mime-type for type x-php but this can be tricked when using the short code for PoC "; $uploadfile="/var/www/s.pht"; $ch =...

Amazon Linux: Security Advisory (ALAS-2012-135)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MS15-100 Microsoft Windows Media Center MCL Vulnerability

This module exploits a vulnerability in Windows Media Center. By supplying an UNC path in the .mcl file, a remote file will be automatically downloaded, which can result in arbitrary code execution. Module Options msf use exploit/windows/fileformat/ms15/100mclexe msf undefined100mclexe show actio...

Directory traversal

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the PATHINFO to the default URI...

Memphis Documents Library < 3.0 - Multiple Issues

- Remote File Inclusion - Local File Inclusion - XSS...

Cisco Integrated Management Controller Supervisor and Cisco UCS Director Remote File Overwrite Vulnerability

Cisco Integrated Management Controller IMC Supervisor and Cisco UCS Director contain a remote file overwrite vulnerability that could allow an unauthenticated, remote attacker to overwrite arbitrary system files, resulting in system instability or a denial of service DoS condition. Cisco has...

BJ Lazy Load <= 0.7.5 - Remote File Inclusion (Timthumb)

The BJ Lazy Load WordPress plugin was affected by a Remote File Inclusion Timthumb security vulnerability...

WordPress Lazy Load Plugin <= 0.7.5 - Remote File Inclusion

This vulnerability allows any visitor to upload any kind of file in your website. Solution Update the plugin...

WordPress BJ Lazy Load Plugin <= 0.7.5 - Remote File Inclusion

This vulnerability allows any visitor to upload any kind of file in your website. Solution Update the plugin...

VulnCheck KEV: CVE-2015-9415

The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion...

CVE-2015-6662

XML external entity XXE vulnerability in SAP NetWeaver Portal 7.4 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2168485...

Rockwell Automation 1766-L32 Series Remote File Inclusion Vulnerability

The Rockwell Automation 1766-L32 Series is a 1766-L32 series programmable logic controller PLC. The Rockwell Automation 1766-L32 Series fails to adequately filter user-submitted input, allowing remote attackers to exploit the vulnerability by submitting a special request to view the contents of...

CVE-2015-5163

The import task action in OpenStack Image Service Glance 2015.1.x before 2015.1.2 kilo, when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image...

Code injection

The import task action in OpenStack Image Service Glance 2015.1.x before 2015.1.2 kilo, when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image...

GNU troff contrib/pdfmark/pdfroff.sh design error vulnerability

Groff GNU Troff is the latest open source implementation of Troff, a document preparation system that generates print and screen documents from the same input source for a variety of devices. GNU troff groff versions prior to 1.21 in contrib/pdfmark/pdfroff.sh starts the Ghostscript program witho...