Multiple vulnerabilities in Drag Drop Mass Upload (ameos_dragndropupload)

It has been discovered that the extension "Drag Drop Mass Upload" ameosdragndropupload is susceptible to Cross-Site Scripting, Cross-Site Request Forgery and Improper Access Control. Release Date: December 15, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3...

WordPress Plugin WP Symposium 14.11 - Arbitrary File Upload

WordPress Plugin WP Symposium 14.11 - Arbitrary File Upload !/usr/bin/python Exploit Name: Wordpress WP Symposium 14.11 Shell Upload Vulnerability Vulnerability discovered by Claudio Viviani Exploit written by Claudio Viviani 2014-11-27: Discovered vulnerability 2014-12-01: Vendor Notification...

CVE-2014-6336

Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 does not properly validate redirection tokens, which allows remote attackers to redirect users to arbitrary web sites and spoof the origin of e-mail messages via unspecified vectors, aka "Exchange URL Redirection...

CVE-2014-6319

Outlook Web App OWA in Microsoft Exchange Server 2007 SP3, 2010 SP3, and 2013 SP1 and Cumulative Update 6 does not properly validate tokens in requests, which allows remote attackers to spoof the origin of e-mail messages via unspecified vectors, aka "Outlook Web App Token Spoofing Vulnerability....

CmsEasy最新版5.5 存储型XSS导致GetShell

简要描述： n处XSS，我不信都插完打不到cookie，get不了shell -.- 详细说明： 第一处（只代码审计第一处，后面几处类似。都是没有过滤）： function loginfalse cookie::set'loginfalse',int cookie::get'loginfalse'+1,time+3600; event::log'loginfalse','失败 user='.front::post'username'; front::flashlang'登陆失败！'."".lang'backuppage'."";...

Clam AntiVirus: Denial of service

Background Clam AntiVirus is an open source GPL anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. Description A heap-based buffer overflow exists in the cliscanpe function in libclamav/pe.c in ClamAV. Impact A remote attacker could possibly cause a Denial of...

SuSE 11.3 Security Update : LibreOffice (SAT Patch Number 10001)

LibreOffice was updated to fix two security issues. These security issues have been fixed : - 'Document as E-mail' vulnerability. bnc900218 - Impress remote control use-after-free vulnerability. CVE-2014-3693 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

CVE-2014-5314

Buffer overflow in Cybozu Office 9 and 10 before 10.1.0, Mailwise 4 and 5 before 5.1.4, and Dezie 8 before 8.1.1 allows remote authenticated users to execute arbitrary code via e-mail messages...

openSUSE Security Update : libreoffice (openSUSE-SU-2014:1443-1)

libreoffice was updated to version 4.3.3 to fix two security issues : These security issues were fixed : - 'Document as E-mail' vulnerability bnc900218. - Impress remote control use-after-free vulnerability CVE-2014-3693. Various other fixes are included in the update. %NASLMINLEVEL 70300 C Tenab...

openSUSE Security Update : libreoffice (openSUSE-SU-2014:1412-1)

libreoffice was updated to fix two security issues. These security issues were fixed : - 'Document as E-mail' vulnerability bnc900218. - Impress Remote Control Use-after-Free Vulnerability CVE-2014-3693. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks ...

Threat Outbreak Alert RuleID12408: Email Messages Distributing Malicious Software on November 13, 2014

Medium Alert ID: 36412 First Published: 2014 November 13 16:57 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID12408 may contain the following files: Name |...

CVE-2014-4311

Epicor Enterprise 7.4 before FS74SP6HotfixTL054181 allows attackers to obtain the 1 Database Connection and 2 E-mail Connection passwords by reading HTML source code of the database connection and email settings page...

Code injection

Epicor Enterprise 7.4 before FS74SP6HotfixTL054181 allows attackers to obtain the 1 Database Connection and 2 E-mail Connection passwords by reading HTML source code of the database connection and email settings page...

CVE-2014-4311

Epicor Enterprise 7.4 before FS74SP6HotfixTL054181 allows attackers to obtain the 1 Database Connection and 2 E-mail Connection passwords by reading HTML source code of the database connection and email settings page...

Multiple Vulnerabilities in Draytek Vigor 2130

VIGOR 2130 firmware 1.5.4.9 1.1. Command injection in traceroute functionality A user can execute arbitrary commands RCE on the router by abusing the traceroute functionality. The interface expects an IP address as input, but does not validate the input. Just provide the input: ; id The above...

CVE-2014-1572

The confirmcreateaccount function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for the realname parameter, which allows remote attacke...

Epicor Enterprise 7.4 - Multiple Vulnerabilities

Epicor suffers from cross site scripting and password disclosure vulnerabilities. "Epicor Enterprise vulnerabilities" - Affected vendor: Epicor Software Corporation - Affected system: Epicor Enterprise - Version 7.4 - Vendor disclosure date: May 13th, 2014 - Public disclosure date: September 30th...

CVE-2012-2588

Multiple cross-site scripting XSS vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, or 3 Subject header or 4 body in an SMTP e-mail message...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, or 3 Subject header or 4 body in an SMTP e-mail message...

CVE-2012-2588

Multiple cross-site scripting XSS vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, or 3 Subject header or 4 body in an SMTP e-mail message...