PT-2014-5155

Name of the Vulnerable Software and Affected Versions Collabtive version 1.2 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the folder parameter in a "fileview list" action to "manageajax.php" API endpoint. Recommendations...

CVE-2014-3246: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via the folder parameter in a fileviewlist action to manageajax.php...

Dropbox Patches Shared Links Privacy Vulnerability

Dropbox has acknowledged and disabled a vulnerable shared links feature that exposed documents stored by the service to third parties. Shared links are a collaboration feature that allows user, especially in a business environment, to share and edit documents. Dropbox rival Intralinks reported th...

CVE-2014-1841

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. dot dot in the src parameter...

Directory traversal

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. dot dot in the src parameter...

Directory traversal

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. dot dot in the src parameter...

CVE-2014-1841

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. dot dot in the src parameter...

Microsoft Windows Compressed Folder Exploit Download Code Execution - Ver2 (CVE-2004-0575)

A code execution vulnerability has been reported in Microsoft Windows. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

FTP Drive + HTTP 1.0.4 Code Execution

Document Title: =============== FTP Drive + HTTP 1.0.4 iOS - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1231 Release Date: ============= 2014-03-20 Vulnerability Laboratory ID VL-ID: ====================================...

NCC00643 Technical Advisory: Nessus Authenticated Scan Local Privilege Escalation

...................................... Vulnerability Summary ...................................... Title Nessus Authenticated Scan - Local Privilege Escalation Release Date 20 March 2014 Reference NGS00643 Discoverer Neil Jones Vendor Tenable Vendor Reference RWZ-21387-181 Systems Affected Nessu...

FTP Drive + HTTP 1.0.4 iOS - Code Execution Vulnerability

Document Title: =============== FTP Drive + HTTP 1.0.4 iOS - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1231 Release Date: ============= 2014-03-20 Vulnerability Laboratory ID VL-ID: ====================================...

Confirmed: Samsung Galaxy S5 has a Fingerprint Scanner

After the huge success of Samsung galaxy S3, Samsung Galaxy S4 and Samsung Tablets, the world’s most successful Android manufacturer is going to reveal its brand new Smartphone Samsung Galaxy S5 next week at Mobile World. Early in 2014, rumors suggested that Samsung Galaxy S5 will have Fingerprin...

CVE-2013-2585

Cross-site scripting XSS vulnerability in Atmail Webmail Server 6.6.x before 6.6.3 and 7.0.x before 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId//filenameOriginal/...

CVE-2013-2639

Cross-site scripting XSS vulnerability in CTERA Cloud Storage OS before 3.2.29.0, 3.2.42.0, and earlier allows remote attackers to inject arbitrary web script or HTML via the description in a project folder...

PT-2014-2604

Name of the Vulnerable Software and Affected Versions CTERA Cloud Storage OS versions prior to 3.2.29.0 CTERA Cloud Storage OS versions prior to 3.2.42.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the description in a project...

McAfee VirusScan Enterprise 8.8 < 8.8 Patch 1 DoS

The remote Windows host has a version of McAfee VirusScan Enterprise VSE 8.8 prior to 8.8 Patch 1. It is, therefore, affected by a denial of service vulnerability due to a flaw in Self Protection. Malicious software can change the NTFS folder permissions on VSE folders and disable the software. C...

pChart 2.1.3 Cross Site Scripting / Directory Traversal

Exploit Title: pChart 2.1.3 Directory Traversal and Reflected XSS Date: 2014-01-24 Exploit Author: Balazs Makany Vendor Homepage: www.pchart.net Software Link: www.pchart.net/download Google Dork: intitle:"pChart 2.x - examples" intext:"2.1.3" Version: 2.1.3 Tested on: N/A Web Application. Tested...

CVE-2014-1636: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to 1 adminschoolnames.php, 2 adminsubjects.php, 3 admingrades.php, 4 adminterms.php, 5 adminschoolyears.php, 6...

CVE-2013-2152

Unquoted Windows search path vulnerability in the SPICE service, as used in Red Hat Enterprise Virtualization RHEV 3.2, allows local users to gain privileges via a crafted application in an unspecified folder...

eFront LMS 3.6.14 File Upload / Path Disclosure

============================================================= \ \ / / | | / \ / | | \ \ V / | | | | | | | | | / \ | ' \ | | | | | | | | | | | | '| | / / . \ | | | | | | || | | | | | | | | | // \ | ./ || / || || |/ || | | || blackpentesters.blogspot.com...