2245 matches found
Design/Logic Flaw
DISPUTED zbsystem/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability...
CVE-2018-19556
CVE-2018-19556 affects Z-BlogPHP 1.5, specifically the endpoint zb_system/admin/index.php?act=UploadMng. The vulnerability description states that file preview handling in this endpoint mishandles previews, which could lead to content spoofing. The reports note that the software maintainer disput...
CVE-2018-19556
zbsystem/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability...
Z-BlogPHP Content Spoofing Vulnerability
Z-BlogPHP is an open source PHP-based blogging system developed by the Z-Blog community. A security vulnerability exists in the zbsystem/admin/index.php?act=UploadMng URL in Z-BlogPHP version 1.5, which stems from the program not handling file previews correctly. An attacker can exploit the...
CVE-2018-19463
zbsystem/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zbsystem/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP b...
Authentication flaw
DISPUTED zbsystem/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zbsystem/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can...
CVE-2018-19463
zbsystem/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zbsystem/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP b...
CVE-2018-19463
Z-BlogPHP
CVE-2018-19463
zbsystem/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zbsystem/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP b...
PT-2018-14968 · Z Blogphp · Z-Blogphp
Name of the Vulnerable Software and Affected Versions: Z-BlogPHP versions prior to 1.5.1 Description: The issue allows remote attackers to execute arbitrary PHP code by uploading an image with the image/jpeg content type to the "zb system/admin/index.php?act=UploadMng" API endpoint. This requires...
z-i-g.de XSS vulnerability
Open Bug Bounty ID: OBB-697335 Description| Value ---|--- Affected Website:| z-i-g.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...
CVE-2018-12414
The CVE-2018-12414 entry affects TIBCO Rendezvous components (rvrd, rvrsd, rvsd, rvcache, rvdm) and related editions. A CSRF flaw exists that could let an attacker reconfigure messaging and potentially access all data routed by RV. Affected versions are: RV 8.4.5 and earlier, RV Developer Edition...
Security Bulletin: Open Source Apache CXF Vulnerabilities
Summary Apache CXF is vulnerable to a denial of service. By using a specially crafted message attachment header, a remote attacker could exploit this vulnerability to cause the AX-WS and JAX-RS services stop responding. Vulnerability Details CVEID: CVE-2017-12624 DESCRIPTION: Apache CXF is...
zsh: Stack-based buffer overflow in gen_matches_files() at compctl.c
A buffer overflow flaw was found in the zsh shell auto-complete functionality. A local, unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use auto-complete to traverse the before mentioned path. If the user affect...
zsh: NULL dereference in cd in sh compatibility mode under given circumstances
A NULL pointer dereference flaw was found in the code responsible for the cd builtin command of the zsh package. An attacker could use this flaw to cause a denial of service by crashing the user shell...
Low: Red Hat Security Advisory: qemu-kvm-ma security, bug fix, and enhancement update
An update for qemu-kvm-ma is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
CVE-2018-18842
CSRF exists in zbusers/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 Zero, which allows remote attackers to execute arbitrary PHP code...
Cross site request forgery (csrf)
CSRF exists in zbusers/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 Zero, which allows remote attackers to execute arbitrary PHP code...
CVE-2018-18842
CVE-2018-18842 : Z-BlogPHP 1.5.2.1935 (Zero) is affected by a CSRF vulnerability in zb_users/plugin/AppCentre/theme.js.php. The flaw permits remote attackers to execute arbitrary PHP code on the affected system. The root cause is a CSRF in the theme.js.php file, enabling code execution when an at...