PT-2017-13224

Name of the Vulnerable Software and Affected Versions BlackCat CMS version 1.2 Description The issue allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file. This is possible through the backend/addons/install.php endpoint. Recommendations For...

BlackCat CMS Arbitrary PHP Code Execution Vulnerability

BlackCat CMS is a PHP5, HTML5 content management system. An arbitrary PHP code execution vulnerability exists in the backend/addons/install.php file in BlackCat CMS, which can be exploited by remote attackers to execute arbitrary PHP code via a ZIP archive containing the .php file...

CVE-2017-14050: Unrestricted Upload of File with Dangerous Type

In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file...

CVE-2017-14048: Cross-Site Request Forgery (CSRF)

BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted newmodulename parameter to backend/addons/ajaxcreate.php. NOTE: this can be exploited via CSRF...

CVE-2015-2690

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

CVE-2015-2690

CVE-2015-2690 affects FreePBX Digium Addons (digiumaddoninstaller) before 2.11.0.7. Multiple XSS flaws exist in views/add-license-form.php invoked via admin/config.php (type=setup, display=digiumaddons, page=add-license-form, addon=ffa). The attacker can inject script/HTML through any of 12 param...

CVE-2015-2690

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

CVE-2015-2690: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

PT-2017-6607

Name of the Vulnerable Software and Affected Versions FreePBX Digium Addons module digiumaddoninstaller versions prior to 2.11.0.7 Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters in an add-license-form page. The vulnerable parameters...

UBUNTU-CVE-2017-5393

The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site. This could allow malicious extensions to install additional extensions from the CDN in combination with an XSS attack on Mozilla AMO sites. This vulnerability affects...

Fedora Update for kdepim-addons FEDORA-2016-1b042a79bd

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 24 Update: kdepim-addons-16.08.2-1.fc24

Additional plugins for KDE PIM applications...

UBUNTU-CVE-2016-5284

Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org...

WooCommerce Product Addons <= 1.1 - Arbitrary File Upload

The PPOM for WooCommerce WordPress plugin was affected by an Arbitrary File Upload security vulnerability...

Firefox Security Toolkit

Firefox Security Toolkit will download the most important security extensions and add them all into your browser. All the extensions have been chosen by a survey among the information security community. Based on the results, the Firefox Security Toolkit was made. Also, the Firefox Security Toolk...

Fedora 22 : firefox-46.0.1-1.fc22 (2016-e2acbd739f)

new upstream version 46.0.1 - fixed focus on TWM rhbz1322626 ---- - Fixed wrong keyboard focus rhbz1322626 ---- - New upstream version 46.0 - Fixed aarch64/ppc64le build failures - Fixed missing addons/langpacks Note that Tenable Network Security has extracted the preceding description block...

XBMC/KODI ADDONS EXPLORER - BSD license, Base64 encoded String, Customized SSL vulnerabilities

HackApp vulnerability scanner discovered that application XBMC/KODI ADDONS EXPLORER published at the 'play' market has multiple vulnerabilities...

Appie v3 - Android Pentesting Portable Integrated Environment

Appie is a software package that has been pre-configured to function as an Android Pentesting Environment on any windows based machine without the need of a Virtual MachineVM or dualboot. It is completely portable and can be carried on USB stick or your smartphone. It is one of its kind Android...

Mageia: Security Advisory (MGASA-2016-0033)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2015-0450)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...