PT-2014-4914

Name of the Vulnerable Software and Affected Versions WD Arkeia virtual appliance AVA versions prior to 10.2.9 Description A directory traversal issue exists, allowing remote attackers to read arbitrary files and execute arbitrary PHP code. This is achieved by manipulating the lang Cookie paramet...

CVE-2014-0342: Undefined Security Weakness

Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a 1 .php or 2 .php extension, and then accessing it via unspecified vectors...

PT-2014-3573

Name of the Vulnerable Software and Affected Versions PivotX versions prior to 2.3.9 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .php or .php extension. This can be achieved by accessing the uploaded file via unspecified vectors...

pivotx -- Multiple unrestricted file upload vulnerabilities

Pivotx reports: Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a 1 .php or 2 .php extension, and then accessing it via unspecified vectors...

CVE-2014-1691: Improper Control of Generation of Code

The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the formvars form...

Design/Logic Flaw

Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors. NOTE: this entry has been SPLIT due to different affected versions. The core/settings.php issue is covered ...

Design/Logic Flaw

Unspecified vulnerability in core/settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors. NOTE: this issue was SPLIT from CVE-2013-0303 due to different affected versions...

CVE-2013-0303

Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors. NOTE: this entry has been SPLIT due to different affected versions. The core/settings.php issue is covered ...

CVE-2013-0303: Undefined Security Weakness

Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors. NOTE: this entry has been SPLIT due to different affected versions. The core/settings.php issue is covered ...

PT-2014-3380

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 ownCloud versions 4.5.x prior to 4.5.6 Description The issue allows remote authenticated users to execute arbitrary PHP code. Recommendations For ownCloud versions prior to 4.0.12, update to version 4.0.12 or...

CVE-2011-5273

Directory traversal vulnerability in shared/package-installer in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary PHP code via a .. dot dot in the pkg parameter in a doinstall action to dtc/...

PT-2014-2189

Name of the Vulnerable Software and Affected Versions Domain Technologie Control DTC versions prior to 0.34.1 Description A directory traversal issue exists, allowing remote authenticated users to execute arbitrary PHP code. This is achieved by including a .. dot dot in the pkg parameter within a...

CVE-2013-2089

Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data...

CVE-2013-2089

Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data...

CVE-2013-1850

Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...

CVE-2013-2089: Undefined Security Weakness

Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data...

CVE-2013-1850: Improper Control of Generation of Code

Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...

PT-2014-2548

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.6 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file and then accessing it via a direct request to the file in /data. Recommendations For versions...

PT-2014-2504

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.13 ownCloud versions 4.5.x prior to 4.5.8 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file due to multiple incomplete blacklist vulnerabilities i...

CVE-2014-2088

Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using a .php filename in an uploadfiles action to the uploadFiles command, and then accessing the .php file via a direct request to a certain clientid pathname...