php: Security update (7 CVEs)

The php package has been rebuilt and was uploaded to the Chaos Calmer 15.05 repository due to multiple security issues. VERSION 5.6.8-1 = 5.6.17-1 CHANGELOG Sun, 24 Jan 2016 21:47:52 +0100 18d121b Update to 5.6.17 Fixes CVE-2016-1903. Wed, 23 Dec 2015 16:00:14 -0500 766cfcc Update to 5.6.16 Wed, ...

By multipart/form-data bypass the waf-vulnerability warning-the black bar safety net

LuManager high-riskSQL injection0day analysis mentioned in the monitoring to use the payload as follows: ! You can see the attacker using the multipart/form-data format send the payload to. For applications, and using application/x-www-form-urlencoded access to the data is consistent. About...

Wave by wave cms file upload vulnerability

Wave CMS is the use of dotNET2.0 technology platform architecture, based on MSSQL2005 compatible with MSSQL2000 technology development of the site management system. Wave CMS file upload vulnerability, /Plugins/swfFileUpload/UploadHandler.ashx global filtering, can be bypassed by rewriting the ca...

Qualsoft Systems - Auth ByPass Vulnerability

Exploit for php platform in category web applications Title : Qualsoft Systems - AddNewsDetails.php Auth ByPass Vulnerability Dork : intext:Powered by Qualsoft Systems Pvt. Ltd demo : http://www.dnyanada.net/ firt you go here: localhost/AddNewsDetails.php after you go here:...

CVE-2006-3731

Mozilla Firefox 1.5.0.4 and earlier allows remote user-assisted attackers to cause a denial of service crash via a form with a multipart/form-data encoding and a user-uploaded file. NOTE: a third party has claimed that this issue might be related to the LiveHTTPHeaders extension...

CVE-2015-5188

Cross-site request forgery CSRF vulnerability in the Web Console web-console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitra...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Web Console web-console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitra...

CVE-2015-5188

Cross-site request forgery CSRF vulnerability in the Web Console web-console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitra...

PT-2015-2597 · Red Hat · Red Hat Jboss Enterprise Application Platform +1

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Application Platform versions prior to 6.4.4 WildFly versions prior to 2.0.0.CR9 Description: A cross-site request forgery CSRF issue in the Web Console allows remote attackers to hijack the authentication of administrators...

EAP: CSRF vulnerability in EAP & WildFly Web Console

It was discovered that when uploading a file using a multipart/form-data submission to the EAP Web Console, the Console was vulnerable to Cross-Site Request Forgery CSRF. This meant that an attacker could use the flaw together with a forgery attack to make changes to an authenticated instance...

Drupal amoCRM module cross-site scripting vulnerability

Drupal is a free, open source content management system developed in PHP. amoCRM module for Drupal is a sales management Web service for Drupal. A cross-site scripting vulnerability in Drupal amoCRM module 7.x-1.2 before 7.x-1.x allows remote attackers to inject arbitrary web script or HTML via...

F5 BIG-IP - PHP vulnerability CVE-2015-4024

The remote host is missing a security patch. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:f5:big-ip"; if description...

WordPress Accurate Form Data Plugin <= 1.2 - Multiple Vulnerabilities

This plugin is prone to a cross site request forgery and cross site scripting vulnerabilities. Solution No fix available...

WordPress Accurate Form Data Plugin <= 1.2 - Multiple Vulnerabilities

This plugin is prone to a cross site request forgery and cross site scripting vulnerabilities. Solution No fix available...

WordPress WP Accurate Form Data 1.2 XSS / CSRF

Title: WordPress 'WP Accurate Form Data' Plugin Version: 1.2 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-21 Download: - https://wordpress.org/plugins/accurate-form-data-real-time-form-validation/ - https://plugins.svn.wordpress.org/accurate-form-data-real-time-form-validatio...

[USN-2658-1] PHP vulnerabilities

========================================================================== Ubuntu Security Notice USN-2658-1 July 06, 2015 php5 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...

Oracle Linux 6 : php (ELSA-2015-1218)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1218 advisory. - fix patch for CVE-2015-4024 - core: fix multipart/form-data request can use excessive amount of CPU usage CVE-2015-4024 - fix various functions accep...

php: multipart/form-data request parsing CPU usage DoS

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time...

php: multipart/form-data request parsing CPU usage DoS

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time...

php security update

5.3.3-46 - fix gzfile accept paths with NUL character 1213407 - fix patch for CVE-2015-4024 5.3.3-45 - fix more functions accept paths with NUL character 1213407 5.3.3-44 - soap: missing fix for 1222538 and 1204868 5.3.3-43 - core: fix multipart/form-data request can use excessive amount of CPU...