976 matches found
Flash Player <= 16.0.0.235 Multiple Vulnerabilities (APSB15-01)
According to its version, the installation of Adobe Flash Player installed on the remote Windows host is equal or prior to 16.0.0.235. It is, therefore, affected by the following vulnerabilities : - An unspecified improper file validation issue. CVE-2015-0301 - An unspecified information disclosu...
Flash Player For Mac <= 16.0.0.235 Multiple Vulnerabilities (APSB15-01)
According to its version, the installation of Adobe Flash Player installed on the remote Mac OS X host is equal or prior to 16.0.0.235. It is, therefore, affected by the following vulnerabilities : - An unspecified improper file validation issue. CVE-2015-0301 - An unspecified information...
Adobe AIR <= 15.0.0.356 Multiple Vulnerabilities (APSB15-01)
According to its version, the Adobe AIR installed on the remote Windows host is equal or prior to 15.0.0.356. It is, therefore, affected by the following vulnerabilities : - An unspecified improper file validation issue. CVE-2015-0301 - An unspecified information disclosure vulnerability, which c...
Google Chrome < 39.0.2171.99 Multiple Vulnerabilities (Mac OS X)
The version of Google Chrome installed on the remote Mac OS X host is a version prior to 39.0.2171.99. It is, therefore, affected by the following vulnerabilities : - An unspecified improper file validation issue. CVE-2015-0301 - An unspecified information disclosure vulnerability, which can be...
Adobe Flash Player Improper File Validation (APSB15-01: CVE-2015-0301)
An improper file validation issue has been reported in Adobe Flash Player. The vulnerability occurs when the Flash Broker application allows malicious dlls or exes files to be written to one of the whitelisted directories. such a malicious dll dropped in these directories could be used to deliver...
WordPress Symposium Plugin Unauthenticated Shell Upload (CVE-2014-10021)
WordPress Symposium plugin allows user to upload files without proper validation of file type. Successful exploitation of this issue may allow execution of arbitrary code on a vulnerable system...
CVE-2014-6622
Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote attackers to determine the validity of filenames via unspecified vectors...
CVE-2014-3349
Cisco Intelligent Automation for Cloud aka Cisco Cloud Portal does not validate file types during the handling of file submission, which allows remote authenticated users to upload arbitrary files via a crafted request, aka Bug ID CSCuh87410...
CVE-2014-3349
Cisco Intelligent Automation for Cloud (Cisco Cloud Portal) suffers an arbitrary file upload vulnerability due to insufficient input validation of file types during file submission. An authenticated, remote attacker could submit a crafted file to an affected device, enabling arbitrary file upload...
CVE-2014-3349
Cisco Intelligent Automation for Cloud aka Cisco Cloud Portal does not validate file types during the handling of file submission, which allows remote authenticated users to upload arbitrary files via a crafted request, aka Bug ID CSCuh87410...
CVE-2014-5100
Multiple cross-site request forgery CSRF vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new super user account via a request to admin/users/add, 2 insert cross-site scripting XSS sequences via the apikeylabel...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new super user account via a request to admin/users/add, 2 insert cross-site scripting XSS sequences via the apikeylabel...
Omeka 2.2.1 - Remote Code Execution Exploit
No description provided by source. !/usr/bin/env python Omeka 2.2.1 Remote Code Execution Exploit Vendor: Omeka Team CHNM GMU Product web page: http://www.omeka.org Affected version: 2.2.1 and 2.2 Summary: Omeka is a free, flexible, and open source web-publishing platform for the display of...
Omeka 2.2 Cross Site Request Forgery / Cross Site Scripting
Omeka...
VBZoom 1.0 - Arbitrary File Upload Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5926/info It has been reported that VBZoom 1.01 may allow attackers to upload arbitrary files to a vulnerable system. The vulnerability is the result of VBZoom failing to properly validate the types of files that are...
mkportal <= 1.2.1 () Multiple Vulnerabilities
No description provided by source. waraxe-2009-SA070 - Multiple Vulnerabilities in MKPortal = 1.2.1 ============================================================================== Author: Janek Vind waraxe Date: 15. January 2009 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-70.html...
Discuz! <=2.5 csrf防御绕过
简要描述： 在Discuz! '.gif', 2 = '.jpg', 3 = '.png'; 只检查了后缀而不像3.0以上用库检查了图片格式 漏洞证明： 步骤 1、新建一个获取页面源码 提取formhash 然后用formhash发送添加副站长请求的swf，保存为.jpg后缀 2、注册一个账号，去/home.php?mod=spacecp&ac=avatar上传上一步生成的.jpg后缀的swf文件并抓包 上传后的地址应该是 http://192.168.1.104/ucserver/data/tmp/uploaduid.jpg这样的...
OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars
jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation...
SolarWinds Server and Application Monitor wpdlx Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SolarWinds Server and Application Monitor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exis...
OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars
jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation...