CVE-2018-8908: Cross-Site Request Forgery (CSRF)

An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML page and use it to trick a victim into clicking on it; once executed, a malicious user will be created with admin privileges. This happens...

Frog CMS 0.9.5 Cross Site Request Forgery

Exploit Title:aa Cross Site Request Forgery- Frog CMS Date: 31-03-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://github.com/philippe/FrogCMS Version: 0.9.5 CVE : CVE-2018-8908 Category: Webapp CMS 1...

Frog CMS Arbitrary File Upload Vulnerability

Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. A security vulnerability exists in Frog CMS version 0.9.5 due to a lack of extension detection in the...

Design/Logic Flaw

An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation...

CVE-2014-4912

An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation...

CVE-2014-4912

An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation...

CVE-2014-4912

CVE-2014-4912 affects Frog CMS 0.9.5: Arbitrary file upload due to lack of extension validation. Root cause: missing extension validation. Impact: partial confidentiality, integrity, and availability (CVSS2/3 indicate HIGH/CRITICAL). Exploitation details are not provided in the documents; an expl...

PT-2018-4227

Name of the Vulnerable Software and Affected Versions Frog CMS version 0.9.5 Description An issue was discovered due to a lack of extension validation, allowing for arbitrary file upload. Recommendations For Frog CMS version 0.9.5, consider implementing proper extension validation to prevent...

CVE-2014-4912: Unrestricted Upload of File with Dangerous Type

An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation...

Code injection

In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary when executed. An attacker can abuse this vulnerability by forci...

CVE-2017-17809

In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary when executed. An attacker can abuse this vulnerability by forci...

CVE-2017-17809

The CVE-2017-17809 entry affects Golden Frog VyprVPN for macOS prior to 2.15.0.5828. The vyprvpnservice launch daemon exposes an unprotected XPC service that lets attackers update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary. An attacker could abuse this to ...

PT-2017-15014

Name of the Vulnerable Software and Affected Versions Golden Frog VyprVPN versions prior to 2.15.0.5828 Description The issue concerns an unprotected XPC service in the vyprvpnservice launch daemon, which allows attackers to modify the OpenVPN configuration and arguments passed to the OpenVPN...

CVE-2017-17809: Untrusted Search Path

In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary when executed. An attacker can abuse this vulnerability by forci...

Frog Prince - Base64 encoded String, Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Frog Prince published at the 'play' market has multiple vulnerabilities...

Tap the Frog: Doodle - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Tap the Frog: Doodle published at the 'play' market has multiple vulnerabilities...

Tap the Frog Faster - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Tap the Frog Faster published at the 'play' market has multiple vulnerabilities...

Tap the Frog - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Tap the Frog published at the 'play' market has multiple vulnerabilities...

Frog CMS 0.9.5 - Arbitrary File Upload

Frog CMS 0.9.5 - Arbitrary File Upload Exploit Title: Arbitrary File Upload in Frog CMS 0.9.5 Date : 2014-07-07 Exploit Author : Javid Hussain Vendor Homepage : http://www.madebyfrog.com Exploit-DB Note: All authenticated users can upload files. If the file does not have execute permissions the C...

Frog CMS 0.9.5 - Arbitrary File Upload

Exploit Title: Arbitrary File Upload in Frog CMS 0.9.5 Date : 2014-07-07 Exploit Author : Javid Hussain Vendor Homepage : http://www.madebyfrog.com Exploit-DB Note: All authenticated users can upload files. If the file does not have execute permissions the CMS allows users to change them. No need...