2044 matches found
Arbitrary Command Execution Vulnerability in Knight CMS
Knight CMS Talent System is a professional talent system based on PHP+MYSQL. Knight CMS version 4.1.0 suffers from an arbitrary command execution vulnerability. Due to the Knight CMS V4.1.0 using the tp framework there is a template engine remote code execution vulnerability. Attackers can exploi...
Piwigo 'search_rules.php' Cross-Site Scripting Vulnerability
Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time, and more. A cross-site scripting vulnerability exists in the 'search results front end' feature in Piwigo version 2.8.3. A remote...
Stored Cross-Site Scripting Vulnerability in yiqicms
Yiqicms is a marketing enterprise website system based on SEO-friendly development, using PHP+Mysql open source building system. Yiqicms front-end stored cross-site scripting vulnerabilities. As the foreground to receive msgtitle msgname failed to filter the output code , only msgcotent parameter...
CmsEasy front Desk arbitrary code execution vulnerability
Source link: https://xianzhi.aliyun.com/forum/read/215.html 在补丁页面http://www.cmseasy.cn/patch/show1116.html下载补丁CmsEasyforUploads20161012.zip Modified files no more 通过diff发现补丁中lib/default/toolact.php 392 row cutimageactionfunction is commented out Take a look at this function php /function...
Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions File Containment Vulnerability
Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions are Auto-Matrix USA's building automation front-end solutions for infrastructure, which are primarily deployed stateside in commercial facilities, critical manufacturing and energy and wastewater systems I&C. A...
Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions Information Disclosure Vulnerabilities
Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions are Auto-Matrix USA's building automation front-end solutions for infrastructure, which are primarily deployed stateside in commercial facilities, critical manufacturing and energy and wastewater systems I&C. A...
CVE-2016-2308
American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Front-End Solutions application store passwords in cleartext, which allows remote attackers to obtain sensitive information by reading a file...
CVE-2016-2307
American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Front-End Solutions application allow remote attackers to read arbitrary files via unspecified vectors, as demonstrated by the configuration file...
CVE-2016-2308
The CVE-2016-2308 vulnerability affects American Auto-Matrix Building Automation Front-End Solutions (Aspect-Nexus and Aspect-Matrix) applications prior to version 3.0.0, where passwords are stored in clear text. This enables a remote attacker to read sensitive information from a file on the host...
WordPress N-Media Post Front-end Form Plugin <= 1.0 - Arbitrary File Upload Vulnerability
Arbitrary File Upload Vulnerability was found in WordPress N-Media Post Front-end Form Plugin v1.0. It only validates the file on client-side with JavaScript so the validation can be easily bypassed. Solution Update the plugin...
WordPress Front End File Upload And Manager Plugin <= 3.9 - Arbitrary File Upload
This plugin is prone to an arbitrary file upload vulnerability. Solution Update the plugin...
Front end file upload and manager Plugin <= 3.9 - Arbitrary File Upload
The Frontend File Manager Plugin WordPress plugin was affected by an Arbitrary File Upload security vulnerability...
WordPress Front End Profile Plugin <= 0.2.1 - Multiple Vulnerabilities
This plugin is prone to a privilege escalation and stored cross site scripting vulnerabilities. Solution Update the plugin...
WP Front End Profile <= 0.2.1 - Privilege Escalation & Stored Cross-Site Scripting (XSS)
It is possible to modify a POST request to overwrite user meta including 'wpcapabilities' and 'wpuserlevel' which results in a privilege escalation vulnerability. User input is not sanitised or escaped on output resulting in a stored XSS vulnerability. Timeline: 2016-09-12: Vulnerability found...
Subrion CMS 'front/actions.php' Arbitrary File Deletion Vulnerability
Subrion CMS is a PHP-based content management system. An arbitrary file deletion vulnerability exists in Subrion CMS 'front/actions.php'. An attacker can exploit the vulnerability to delete arbitrary files...
[SECURITY] Fedora 23 Update: drupal7-views-3.14-1.fc23
You need Views if: You like the default front page view, but you find you want to sort it differently. You like the default taxonomy/term view, but you find you want to sort it differently; for example, alphabetically. You use /tracker, but you want to restrict it to posts of a certain type. You...
GDB Front End: PINCE
GDB Front End: PINCE is not Cheat Engine PINCE is a front-end/reverse engineering tool for the GNU Project Debugger GDB, focused on games. But it can be used for any reverse-engineering related stuff. PINCE is an abbreviation for “PINCE is not Cheat Engine”. PINCE’s GUI is heavily “inspired;D” by...
Native applications with OAuth 2
By Justin Richer and Antonio Sanso This article was excerpted from the book OAuth 2 in Action. The OAuth core specification specifies four different grant types: Authorization Code, Implicit, Resource Owner Password Credentials and Client Credentials. Each grant type is designed with different...
Google Chrome Access Restriction Bypass Vulnerability (CNVD-2016-03836)
Google Chrome is a web browsing tool developed by Google. In versions of Google Chrome prior to 51.0.2704.79, Blink/DevTools/WebKit/Source/devtools/frontend/devtools.js does not ensure that the remoteFrontendUrl parameter is associated with the chrome-devtools- frontend.appspot.com URL associatio...