8900 matches found
PT-2014-2315 · Zope +1 · Plone +1
Name of the Vulnerable Software and Affected Versions: Plone versions prior to 4.2.3 Plone version 4.3 before beta 1 Description: The issue allows remote attackers to execute Python code via a crafted URL, related to createObject. This is possible due to a flaw in the python scripts.py module...
CVE-2014-5441
Multiple cross-site scripting XSS vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the 1 username, 2 first name, or 3 last name in a a create or b edit user action...
PT-2014-1961
Name of the Vulnerable Software and Affected Versions Pixman versions prior to 0.32.6 Description The issue is caused by an integer overflow in the create bits function in pixman-bits-image.c. This can be exploited by a remote attacker to cause a denial of service, resulting in the application...
rubygem-activerecord: Strong Parameter bypass with create_with
It was discovered that Active Record's createwith method failed to properly check attributes passed to it. A remote attacker could possibly use this flaw to bypass the strong parameter protection and modify arbitrary model attributes via mass assignment if an application using Active Record calle...
DEBIAN-CVE-2014-3514
activerecord/lib/activerecord/relation/querymethods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes createwith calls...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 create new FTP users via a CreateFTP action in the ftpmanagement module to the default URI, 2 conduct cross-site scriptin...
Ribose Cross Site Request Forgery Vulnerability
The Ribose Online Social Collaboration Platform suffers from a cross site request forgery vulnerability. Vulnerability: CSRF Attack on Ribose Online Social Collaboration Platform Date: 13/08/2014 Author: JoeV Vendor: www.ribose.com Tested on: Windows 7 Description: A CSRF attack forces a logged-o...
SL User Create 0.2.4 - LSL script Secret String Weakness Information Disclosure
The SL User Create WordPress plugin was affected by a LSL script Secret String Weakness Information Disclosure security vulnerability...
CVE-2014-2974: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in php/useraccount.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts...
PT-2014-6282
Name of the Vulnerable Software and Affected Versions ol-commerce version 2.1.1 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the a country parameter in a process action to "affiliate signup.php" or the entry country id parameter in...
PT-2014-6281
Name of the Vulnerable Software and Affected Versions ol-commerce version 2.1.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters in different PHP files, including the a country parameter in the "affiliate signup.php" file...
ZeroCMS 1.0 - Persistent Cross-Site Scripting
Exploit Title: Persistent ZeroCMS Cross-Site Scripting Vulnerability Discovered by: Mayuresh Dani Vendor Homepage: http://www.aas9.in/zerocms/ Software Link: https://github.com/pcx1256/zerocms/archive/master.zip Version: 1.0? Date: 2014-07-25 Tested on: Windows 7 / Mozilla Firefox Ubuntu 14.04 /...
PT-2014-6308 · Hewlett Packard · Hp Data Protector
Name of the Vulnerable Software and Affected Versions: HP Data Protector affected versions not specified Description: The issue allows remote attackers to create arbitrary files via an opcode-1091 request, or create or delete arbitrary files via an opcode-305 request. The vendor reportedly assert...
CVE-2014-2365 Advantech WebAccess Improper Access Control
Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors...
OL-Commerce 2.1.1 Cross Site Scripting / SQL Injection Vulnerabilities
OL-Commerce version 2.1.1 suffers from cross site scripting and remote SQL injection vulnerabilities. OL-Commerce v2.1.1 - Multiple Vulnerabilties =================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : email protected , email protected .:...
OL-Commerce 2.1.1 Cross Site Scripting / SQL Injection
OL-Commerce v2.1.1 - Multiple Vulnerabilties =================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script :...
CVE-2014-4977
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the 2 userid parameter in the changeUnit function, 3 methodDeta...
Computer Software Manufaktur Alibaba 2.0 - Multiple CGI Vulnerabilties
No description provided by source. source: http://www.securityfocus.com/bid/770/info There are several CGI programs that ship with the Alibaba webserver. Many of these do not do proper input handling, and therefore will allow requests for access to files outside of normal or safe webserver...
DirectAdmin 1.34.0 - CSRF Create Administrator Vulnerability
No description provided by source. Vendor: http://www.directadmin.com/ Code : Create Administrator : html titleDirectAdmin v1.34.0 XSRF Create Administrator Vulnerability/title !--!Set You'r victim By SarBoT511 !-- form name=reseller action=http://site.com:2222/CMDACCOUNTADMIN method=post input...
dotProject 2.1.5 CSRF Vulnerability
No description provided by source. Source: http://packetstormsecurity.org/files/view/98245/dotProject2.1.5-xsrf.txt !------------------------------------------------------------------------ Software................dotProject 2.1.5 Vulnerability...........Cross-site Request Forgery...