PT-2015-7430

Name of the Vulnerable Software and Affected Versions Openfire version 3.10.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including the groupchatName parameter, urlName parameter, hostname parameter, or the search parameter in vario...

Synology Download Station Cross-Site Scripting Vulnerability (CNVD-2015-06011)

Synology Download Station is a set of web-based download applications from Synology. A cross-site scripting vulnerability exists in the 'Create download task via URL' feature in Synology Download Station prior to version 3.5-2967, which can be exploited by remote attackers to inject arbitrary web...

PT-2015-7413

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.2.3 Description The issue allows local users to cause a denial of service, potentially leading to a system crash, by utilizing a socket that was not properly bound. This is due to a problem in the rds conn crea...

PT-2015-2023

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The issue exists due to insufficient input validation in the Windows operating system, allowing a local attacker to potentially elevate their privileges using a specially crafted application...

Linux/x86 - Create file with permission 7775 and exit Shell Generator

Linux/x86 - Create file with permission 7775 and exit Shell Generator. Shellcode exploit for linx86 platform !/bin/python from sys import argv """ Shellcode Generator... Create file with permission 7775 --------------------------------------------------------------------------------- Disassembly ...

CVE-2015-5623: Improper Access Control

WordPress before 4.2.3 does not properly verify the editposts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php...

OracleVM 3.3 : net-snmp (OVMSA-2015-0099)

The remote OracleVM system is missing necessary patches to address critical security updates : - Add Oracle ACFS to hrStorage John Haxby orabug 18510373 - Quicker loading of IP-MIB::ipAddrTable 1191393 - Quicker loading of IP-MIB::ipAddressTable 1191393 - Fixed snmptrapd crash when '-OQ' paramete...

Free Reprintables ArticleFR Has Multiple Cross-Site Request Forgery Vulnerabilities

Free Reprintables ArticleFR is an article directory scripting system from Free Reprintables Philippines. Free Reprintables ArticleFR 3.0.6 suffers from multiple cross-site request forgery vulnerabilities that allow remote attackers to hijack an administrator authentication request to add an...

CVE-2015-5530: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request to dashboard/users/create/...

Apple CUPS cupsd Privilege Escalation (CVE-2015-1158)

An elevation-of-privilege vulnerability has been reported in the Apple CUPS. The vulnerability is due to improper processing of print-job or create-job requests sent to cupsd. A remote, unauthenticated attacker can send a specially crafted localized strings to cause the 'admin/conf' and 'admin'...

[SECURITY] Fedora 22 Update: abrt-2.6.0-1.fc22

abrt is a tool to help users to detect defects in applications and to create a bug report with all information needed by maintainer to fix it. It uses plugin system to extend its functionality...

Drupal Petition module cross-site scripting vulnerability (CNVD-2015-03892)

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Petitions is one of the petition modules used in the U.S. White House website. A cross-site scripting vulnerability exists in the administration page of the Drupal Petitions module. A...

Drupal Open Graph Importer Module Limit Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP. open Graph Importer is a module that supports back-end administrators or other users to import content from other websites using open graph meta tags. A security vulnerability exists in the Drupal Open Graph Importer module...

Open redirect

The Open Graph Importer ogtagimporter 7.x-1.x for Drupal does not properly check the create permission for content types created during import, which allows remote authenticated users to bypass intended restrictions by leveraging the "import ogtagimporter" permission...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that 1 create, 2 delete, or 3 alter invoices via unspecified vectors...

CVE-2015-4389: Undefined Security Weakness

The Open Graph Importer ogtagimporter 7.x-1.x for Drupal does not properly check the create permission for content types created during import, which allows remote authenticated users to bypass intended restrictions by leveraging the "import ogtagimporter" permission...

CVE-2015-4377: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in unspecified administration pages in the Petition module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with the "create petition" permission to inject arbitrary web script or HTML via unknown vectors...

CVE-2015-2993

SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to 1 create administrator accounts via a crafted request to /createnewaccount or 2 write to arbitrary files via the fileName parameter to /userentry...

CVE-2015-4051: Improper Access Control

Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service reboot or shutdown, create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a...

Multiple Cross-Site Request Forgery Vulnerabilities in osCMax

osCMax is a PHP-based open source e-commerce system/shopping cart application that supports multi-language, SSL-secured transactions, multiple payment methods, regional shipping conversion, printing invoices and more. Multiple cross-site request forgery vulnerabilities exist in versions of osCMax...