WordPress Splashing Images Plugin PHP Object Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . Splashing Images wp-splashing-images is used in one of the image selection plugin . A PHP object injection...

Red Hat eNovance eDeploy Directory Traversal Vulnerability

Red Hat eNovance eDeploy is an update configuration tool for Linux systems from Red Hat, Inc. A directory traversal vulnerability exists in Red Hat eNovance eDeploy. A remote attacker can exploit this vulnerability to cause a denial of service resource consumption by creating arbitrary directorie...

CVE-2014-3702

Directory traversal vulnerability in eNovance eDeploy allows remote attackers to create arbitrary directories and files and consequently cause a denial of service resource consumption via a .. dot dot the session parameter...

CVE-2014-3702

Directory traversal vulnerability in eNovance eDeploy allows remote attackers to create arbitrary directories and files and consequently cause a denial of service resource consumption via a .. dot dot the session parameter...

CVE-2014-3702: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in eNovance eDeploy allows remote attackers to create arbitrary directories and files and consequently cause a denial of service resource consumption via a .. dot dot the session parameter...

PT-2017-5882

Name of the Vulnerable Software and Affected Versions: eDeploy affected versions not specified Description: A directory traversal issue allows remote attackers to create arbitrary directories and files, potentially causing a denial of service due to resource consumption. This is achieved by...

CVE-2017-11458

Cross-site scripting XSS vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the sessionID parameter, aka SAP Security Note 2406783...

forumsirius.fr XSS vulnerability

Vulnerable URL: http://www.forumsirius.fr/orion/mc2.phtml?session=7dcraurb0d3csc19b7rs1lpmj2="--!" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 21.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 148207 VIP website status:| No Che...

CVE-2016-2840

An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26. The "session" parameter for file-download requests can be used to inject script code that gets reflected through the subsequent status page. Malicious script code can be executed within a trusted domain's context...

PT-2016-5233

Name of the Vulnerable Software and Affected Versions Open-Xchange Server 6 / OX AppSuite versions prior to 7.8.0-rev26 Description An issue was discovered where the session parameter for file-download requests can be used to inject script code, which gets reflected through the subsequent status...

CVE-2016-2840: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26. The "session" parameter for file-download requests can be used to inject script code that gets reflected through the subsequent status page. Malicious script code can be executed within a trusted domain's context...

Pivotx Session Fixation Vulnerability

Pivotx is an open source blog content management system Blog CMS. The system supports built-in comment review, spam protection and template replacement. A session fixation vulnerability exists in the fileupload.php file in Pivotx versions prior to 2.3.11. A remote attacker can exploit this...

CVE-2013-4562

The CVE-2013-4562 weakness affects the omniauth-facebook gem (versions 1.4.1 prior to 1.5.0). The root cause is that the session parameter is not properly stored, enabling remote attackers to perform CSRF via the state parameter. Consequences include potential CSRF attacks against users authentic...

CVE-2013-4562

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter...

CVE-2013-4562

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter...

DEBIAN-CVE-2013-6172

steps/utils/savepref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code...

UBUNTU-CVE-2013-6172

steps/utils/savepref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code...

PT-2013-1084

Name of the Vulnerable Software and Affected Versions Roundcube webmail versions prior to 0.8.7 Roundcube webmail versions 0.9.x prior to 0.9.5 Description The issue allows remote attackers to modify configuration settings via the session parameter. This can be leveraged to read arbitrary files,...

Debian DSA-2787-1 : roundcube - design error

It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, does not properly sanitize the session parameter in steps/utils/savepref.inc during saving preferences. The vulnerability can be exploited to overwrite configuration settings and subsequently allowing rand...

Debian Security Advisory DSA 2787-1 (roundcube - design error)

It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, does not properly sanitize the session parameter in steps/utils/savepref.inc during saving preferences. The vulnerability can be exploited to overwrite configuration settings and subsequently allowing rand...