WSO2 Identity Server SAML Authentication XXE Injection Vulnerability

WSO2 Identity Server is an open source identity services , support for Information Cards, OpenID and XACML. WSO2 Identity Server SAML authentication interface XXE injection vulnerability allows remote attackers to submit special XML data to access arbitrary files...

PT-2015-1244

Name of the Vulnerable Software and Affected Versions ProFTPD version 1.3.5 Description The issue allows remote attackers to read and write to arbitrary files. This is achieved via the site cpfr and site cpto commands, which are part of the mod copy module in the ProFTPD FTP server. Recommendatio...

WordPress Myflash Plugin - Arbitrary File Access

This plugin is prone to myextractXML.php path parameter arbitrary file access vulnerability. Solution Upgrade the plugin...

WordPress Online Store Plugin <= 1.3.1 - Arbitrary File Access

This plugin is prone to an index.php multiple parameter traversal arbitrary file access vulnerability. Solution Update the plugin...

WordPress eShop Magic Plugin <= 0.1 - Local File Inclusion

This plugin is prone to eshop-magic/download.php file parameter traversal arbitrary file access vulnerability. It allows attackers to disclose sensitive information. Solution Update the plugin...

WordPress Gallery Plugin <= 3.8.3 - Arbitrary File Access

This plugin is prone to an arbitrary file access in gallery-plugin.php filename1 parameter. It allows attackers to read arbitrary files. Solution Upgrade plugin...

SQL Buddy /sqlbuddy/ page parameter remote directory traversal vulnerability

SQL Buddy is a nice lightweight ajax database management tool. SQL Buddy fails to properly filter user input, allowing remote attackers to exploit a vulnerability to access arbitrary files via the 'page' parameter...

Google Android Directory Traversal Vulnerability

Android is an operating system based on the Linux open kernel and is a mobile operating system announced on November 5, 2007 by Google Inc. Android 4.4 and other versions suffer from an MTP path traversal vulnerability in their implementation. An attacker can exploit this vulnerability to access ...

Unspecified XXE Injection Vulnerability in IBM InfoSphere MDM Reference Data Management

IBM InfoSphere MDM Reference Data Management provides a range of capabilities essential for seamlessly managing reference data in the information world across different business domains, including comprehensive authoring and lifecycle management capabilities, a version control model, role-based...

MGASA-2015-0138 Updated batik packages fix security vulnerabilities

Updated batik packages fix security vulnerability: Nicolas Gregoire and Kevin Schaller discovered that Batik would load XML external entities by default. If a user or automated system were tricked into opening a specially crafted SVG file, an attacker could possibly obtain access to arbitrary fil...

BOA Web Server 0.94.8.2 - Arbitrary File Access Vulnerability

Exploit for linux platform in category web applications Title: Vulnerability in BOA web server v0.94.8.2 Date: 03/10/2000 Status: Vendor contacted, patch available Scope: Arbitrary file access Author: llmora Release: Public S 2 1 S E C http://www.s21sec.com Vulnerability in BOA web server v0.94.8...

ANTlabs InnGate Firmware Arbitrary File Read/Write Vulnerability

ANTlabs InnGate is a dedicated gateway for hotels. An arbitrary file read/write vulnerability exists in the ANTlabs InnGate firmware, which allows an unauthenticated attacker to exploit the vulnerability to perform read/write operations on the device's file system due to a failure to properly...

Ericsson Drutt MSDP (Instance Monitor) - Directory Traversal Vulnerability

Exploit for php platform in category web applications +------------------------------------------------------------------------------------------------------+ + Ericsson Drutt MSDP Instance Monitor - Directory Traversal Vulnerability and Arbitrary File Access +...

Ericsson Drutt MSDP (Instance Monitor) - Directory Traversal

+------------------------------------------------------------------------------------------------------+ + Ericsson Drutt MSDP Instance Monitor - Directory Traversal Vulnerability and Arbitrary File Access +...

Mandriva Linux Security Advisory : sudo (MDVSA-2015:126)

Updated sudo packages fix security vulnerability : Prior to sudo 1.8.12, the TZ environment variable was passed through unchecked. Most libc tzset implementations support passing an absolute pathname in the time zone to point to an arbitrary, user-controlled file. This may be used to exploit bugs...

WordPress Aspose Doc Exporter File Download

|||||||||||||||||||||||||||||||||||||||||||||||||| |-------------------------------------------------------------------------| | + Exploit Title: Wordpress aspose-doc-exporter Plugin Arbitrary File Download Vulnerability | | + Exploit Author: Ashiyane Digital Security Team | | + Vendor Homepage :...

KLA10506 Multiple vulnerabilities in Websense products

Multiple serious vulnerabilities have been found in Websense products. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, execute or inject arbitrary code, spoof user interface and read or write arbitrary files. Below is a complete lis...

CVE-2014-3578

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL...

MGASA-2015-0079 Updated sudo packages fix CVE-2014-9680

Updated sudo packages fix security vulnerability: Prior to sudo 1.8.12, the TZ environment variable was passed through unchecked. Most libc tzset implementations support passing an absolute pathname in the time zone to point to an arbitrary, user-controlled file. This may be used to exploit bugs ...

Cisco Enterprise Content Delivery System Web Directory Traversal and Arbitrary File Access Vulnerability

A vulnerability in Cisco Enterprise Content Delivery System ECDS could allow an unauthenticated, remote attacker to conduct directory traversal attacks on a targeted system. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could...