104 matches found
Code injection
The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to 1 upload arbitrary XML files via the import page or 2 obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code...
CVE-2014-8598
The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to 1 upload arbitrary XML files via the import page or 2 obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code...
CVE-2014-8598
The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to 1 upload arbitrary XML files via the import page or 2 obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code...
CVE-2014-8598
CVE-2014-8598 affects MantisBT 1.2.x via the XML Import/Export plugin, which could allow unauthorized attackers to upload arbitrary XML files or obtain sensitive information due to insufficient access restrictions. This is explicitly stated in connected documents as part of multiple vulnerabiliti...
Localize: Full Path Disclosure / Info Disclosure in Importing XML Section!
Hello, I found another information disclosure vulnerability/Full Path Disclosure on your application. now its on Import XML Section Proof of Concept ------------------------- POST : http://www.localize.io/import/ project ID POST CONTENT: -----------------------------97823247315770\r\n...
Localize: Full Path Disclosure (2)
During the import of an XML file,I edited the "file" to "url" for importing XML's through URL.So it became: html And then I tried to import a random XML file.I tried with this: http://www.swarthmore.edu/libraries.xml It was not a valid XML file.And after the importing it showed the following erro...
Fedora 18 : zabbix-2.0.8-3.fc18 (2013-18348)
New upstream version 2.0.8 - Patch for CVE-2013-5743 SQL injection vulnerability, ZBX-7091 - Patch for ZBX-6922 Failing host XML import - SQL speed-up patch for graphs ZBX-6804 - Require php-ldap and ZBX-6992 Service SQL - Create and configure a spooling directory for fping files outside of /tmp...
Fedora 20 : zabbix-2.0.8-3.fc20 (2013-18314)
New upstream version 2.0.8 - Patch for CVE-2013-5743 SQL injection vulnerability, ZBX-7091 - Patch for ZBX-6922 Failing host XML import - SQL speed-up patch for graphs ZBX-6804 - Require php-ldap and ZBX-6992 Service SQL - Create and configure a spooling directory for fping files outside of /tmp...
Fedora 19 : zabbix-2.0.8-3.fc19 (2013-18351)
New upstream version 2.0.8 - Patch for CVE-2013-5743 SQL injection vulnerability, ZBX-7091 - Patch for ZBX-6922 Failing host XML import - SQL speed-up patch for graphs ZBX-6804 - Require php-ldap and ZBX-6992 Service SQL - Create and configure a spooling directory for fping files outside of /tmp...
Zoner Photo Studio 15 B3 Buffer Overflow
Title: ====== Zoner Photo Studio v15 b3 - Buffer Overflow Vulnerabilities Date: ===== 2012-11-13 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=759 VL-ID: ===== 759 Common Vulnerability Scoring System: ==================================== 4.5 Introduction: ============...
LimeSurvey 1.92+ Build120620 Remote File Inclusion / Traversal
:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2012-06-22 LimeSurvey 1.92+ build 120620 Multiple Vulnerabilities Script: "LimeSurvey - the free and open source survey software...
phpMyAdmin simplexml_load_string() Function Information Disclosure (PMASA-2011-17)
According to its self-identified version number, the phpMyAdmin install hosted on the remote web server is affected by an information disclosure vulnerability. The vulnerability, which is in the simplexmlloadstring function in the XML import plug-in libraries/import/xml.php in phpMyAdmin 3.3.x...
Debian Security Advisory DSA 2391-1 (phpmyadmin)
The remote host is missing an update to phpmyadmin announced via advisory DSA 2391-1. OpenVAS Vulnerability Test $Id: deb23911.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2391-1 phpmyadmin Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...
Debian: Security Advisory (DSA-2391-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-2391-1 : phpmyadmin - several vulnerabilities
Several vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-4107 The XML import plugin allowed a remote attacker to read arbitrary files via XML data containing...
[SECURITY] [DSA 2391-1] phpmyadmin security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2391-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst January 22, 2012 http://www.debian.org/security/faq -...
DSA-2391-1 phpmyadmin - several
Bulletin has no description...
Fedora 14 : phpMyAdmin-3.4.7.1-1.fc14 (2011-15831)
Changes for 3.4.7.1 2011-11-10 : - security Fixed possible local file inclusion in XML import CVE-2011-4107 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as mu...
CVE-2011-4107
The simplexmlloadstring function in the XML import plug-in libraries/import/xml.php in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity XXE injection...
Xxe
The simplexmlloadstring function in the XML import plug-in libraries/import/xml.php in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity XXE injection...