CVE-2015-8309

Cherry Music (the CherryMusic project) contains a directory traversal vulnerability (CVE-2015-8309) affecting versions before 0.36.0. The flaw allows remote authenticated users to read arbitrary files via the value parameter to the download endpoint, due to insufficient validation in the file pat...

CVE-2015-8309

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."...

CVE-2015-8309

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."...

CVE-2015-8310

Cherry Music (before 0.36.0) is affected by an XSS vulnerability where remote authenticated users can inject arbitrary script/HTML via the playlistname field when creating a new playlist. This is the concrete vulnerability described across multiple connected references and CVE records. The docume...

CVE-2015-8310

Cross-site scripting XSS vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist...

CVE-2015-8310

Cross-site scripting XSS vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist...

CVE-2015-8310: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist...

PT-2017-7392

Name of the Vulnerable Software and Affected Versions Cherry Music versions prior to 0.36.0 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when...

PT-2017-7391

Name of the Vulnerable Software and Affected Versions Cherry Music versions prior to 0.36.0 Description A directory traversal issue allows remote authenticated users to read arbitrary files. This is achieved via the value parameter to the "download" API endpoint. Recommendations For versions prio...

CVE-2015-8309: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."...

cherry music Arbitrary File Disclosure Vulnerability

cherry music is a music product. An arbitrary file disclosure vulnerability exists in cherry music version 0.35.1, which allows an attacker to download arbitrary files without authentication...

Cherry Music 0.35.1 Arbitrary File Disclosure

Exploit Title: Cherry Music v0.35.1 directory traversal vulnerability allows authenticated users to download arbitrary files Date: 11-09-2016 Exploit Author: feedersec Contact: [email protected] Vendor Homepage: http://www.fomori.org/cherrymusic/index.html Software Link:...

Cherry Music 0.35.1 - Arbitrary File Disclosure

Exploit for php platform in category web applications Exploit Title: Cherry Music v0.35.1 directory traversal vulnerability allows authenticated users to download arbitrary files Date: 11-09-2016 Exploit Author: feedersec Contact: email protected Vendor Homepage:...

Cherry Music 0.35.1 - Arbitrary File Disclosure

Cherry Music 0.35.1 - Arbitrary File Disclosure Exploit Title: Cherry Music v0.35.1 directory traversal vulnerability allows authenticated users to download arbitrary files Date: 11-09-2016 Exploit Author: feedersec Contact: [email protected] Vendor Homepage:...

Cherry Music 0.35.1 - Arbitrary File Disclosure

Exploit Title: Cherry Music v0.35.1 directory traversal vulnerability allows authenticated users to download arbitrary files Date: 11-09-2016 Exploit Author: feedersec Contact: [email protected] Vendor Homepage: http://www.fomori.org/cherrymusic/index.html Software Link:...

CHERRY B.UNLIMITED AES JD-0400EU-2/01 Crypto Issues / Replay Attacks

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2016-031 Product: CHERRY B.UNLIMITED AES Manufacturer: Cherry GmbH Affected Versions: JD-0400EU-2/01 Tested Versions: JD-0400EU-2/01 Vulnerability Type: Cryptographic Issues CWE-310 Missing Protection against Replay Attacks Risk...

CHERRY B.UNLIMITED AES JD-0400EU-2/01 Insufficient Protections

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2016-032 Product: CHERRY B.UNLIMITED AES Manufacturer: Cherry GmbH Affected Versions: JD-0400EU-2/01 Tested Versions: JD-0400EU-2/01 Vulnerability Type: Insufficient Protection of Code Firmware and Data Cryptographic Key Risk Level...

Cherry Plugin < 1.2.7 - Unauthenticated Arbitrary File Upload and Download

The cherry plugin WordPress plugin was affected by an unauthenticated file upload and download vulnerability, allowing attackers to upload and download arbitrary files. This could result in attacker uploading backdoor shell scripts or downloading the wp-config.php file. PoC Upload: The following...

Cherry Plugin < 1.2.7 - Unauthenticated Arbitrary File Upload and Download

The cherry plugin WordPress plugin was affected by an unauthenticated file upload and download vulnerability, allowing attackers to upload and download arbitrary files. This could result in attacker uploading backdoor shell scripts or downloading the wp-config.php file. Upload: The following file...

Cherry Chaser Slot Machine - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Cherry Chaser Slot Machine published at the 'play' market has multiple vulnerabilities...