Cisco Web Security Appliance Certificate Generation Command Injection Vulnerability

A vulnerability in the certificate generation process in the admin web interface of the Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to execute arbitrary commands on an affected system with root-level privileges. The vulnerability is due to the improper...

Netgear routers multiple security vulnerabilities

Administration interface is accessible without password validation, CSRF...

Wordpress EZ Portfolio 1.0.1 plugin - Multiple Persistant XSS Vulnerability

Exploit for php platform in category web applications Title : Wordpress EZ Portfolio 1.0.1 plugin - Multiple Persistant XSS vulnerability Author : ZwX Date : 22/02/2015 Downoload : https://downloads.wordpress.org/plugin/ez-portfolio.1.0.1.zip Vendor : http://webbisivut.org/ Level Security : Low...

Netgear N300 Authentication Bypass Vulnerability

Netgear N300 routers suffer from an authentication bypass vulnerability that allows for complete compromise. COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Netgear Router Firmware N3001.1.0.311.0.1.img and N300-1.1.0.281.0.1.img Vendor: NETGEAR CVE ID: requeste...

WordPress Contact Form Generator plugin cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . contact Form Generator is one of the contact form generator plugin . A cross-site request forgery vulnerability...

Octogate UTM 3.0.12 - Admin Interface Directory Traversal Vulnerability

Exploit for php platform in category web applications Exploit Title: Octogate UTM Admin Interface Directory Traversal Date: 26.08.2015 Software Link: http://www.octogate.com Exploit Author: Oliver Karow Contact: email protected Website: http://www.oliverkarow.de Category: Remote Exploit Affected...

Wing FTP 4.4.6 Cross Site Request Forgery

Exploit Title: Wing FTP Server Cross-site Request Forgery vulnerabilities Product: Wing FTP Server Vulnerable Versions: 4.4.6 and all previous versions Tested Version: 4.4.6 Advisory Publication: 05/06/2015 Latest Update: 05/06/2015 Vulnerability Type: Cross-site Request Forgery CWE-352 CVE...

WordPress plugin WP Photo Album stores cross-site scripting vulnerabilities

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin WP Photo Album. Due to the lack of user-supplied filters for scripts passed to the...

Oracle Commerce Platform A vulnerability exists in the Commerce Platform component

Oracle Commerce Platform is the United States Oracle Oracle company's set of e-business solutions platform. A security vulnerability exists in the Dynamo Application Framework - HTML Admin User Interface subcomponent of the Oracle Commerce Platform component of Oracle Commerce Platform. A remote...

FreePBX suffers from multiple cross-site scripting vulnerabilities (CNVD-2015-02675)

FreePBX is an open source, web-based PBX solution. FreePBX has multiple cross-site scripting vulnerabilities. Due to multiple HTTP POST parameters passed to the "/admin/config.php" script when "type" is set to "setup", "display" to "digiumaddons", "page" to "add-license-form", and "addon" to "ffa...

Landesk Management Suite 9.5 RFI / CSRF Vulnerabilities

Landesk Management Suite version 9.5 suffers from cross site request forgery and remote file inclusion vulnerabilities. Exploit Title: Landesk Management Suite RFI and CSRF vulnerabilities Product: Landesk Management Suite Vulnerable Versions: 9.5 and possible previous versions, 9.6 Tested Versio...

Debian DLA-65-1 : python-django security update

This update address an issue with reverse generating external URLs; a denial of service involving file uploads; a potential session hijacking issue in the remote-user middleware; and a data leak in the administrative interface. http://www.freexian.com/services/debian-lts.html CVE-2014-0480 Django...

DEBIAN-CVE-2015-2241

Cross-site scripting XSS vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonlyfields, as demonstrated by a @property...

WordPress Plugin Huge IT Slider SQL Injection Vulnerability

WordPress is a use of PHP language development blog platform, users can support PHP and MySQL database server set up their own weblog. A SQL injection vulnerability exists in the WordPress plugin Huge IT Slider. The vulnerability is caused due to the failure to filter input passed to the...

Cross site scripting

Cross-site scripting XSS vulnerability in the admin interface in LANDESK Management Suite before 9.6 SP1 allows remote attackers to inject arbitrary web script or HTML via the AMTVersion parameter to remote/serverlistgrouptree.aspx...

CVE-2014-5360

Cross-site scripting XSS vulnerability in the admin interface in LANDESK Management Suite before 9.6 SP1 allows remote attackers to inject arbitrary web script or HTML via the AMTVersion parameter to remote/serverlistgrouptree.aspx...

CVE-2014-5360

Cross-site scripting XSS vulnerability in the admin interface in LANDESK Management Suite before 9.6 SP1 allows remote attackers to inject arbitrary web script or HTML via the AMTVersion parameter to remote/serverlistgrouptree.aspx...

CVE-2015-1058

Multiple cross-site scripting XSS vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dataCategorytitle parameter to admin/categories/add, 2 dataFieldtitle parameter to admin/fields/ajaxfields/, 3 name property in a basicInfo JSON object to...

CVE-2014-100035

SQL injection vulnerability in the ticket grid in the admin interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the ticket grid in the admin interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...