CollabNet Subversion Edge Management 4.0.11 - Local File Inclusion

Vuln Title: Local file inclusion in CollabNet Subversion Edge Management Frontend via logfile "fileName" parameter of the "tail" action Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type: Local...

CollabNet Subversion Edge Management Credential Leak

Vuln Title: The CollabNet Subversion Edge Management frontend user credential hash leak Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type: Credential leak Risk: Medium Status: public/fixed Fixed...

CollabNet Subversion Edge Management downloadHook LFI

Vuln Title: Local file inclusion in CollabNet Subversion Edge Management Frontend via logfile "filename" parameter of the "downloadHook" action Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type:...

TYPO3 Frontend User Upload Arbitrary File Upload Vulnerability

TYPO3 is a free and open source content management system, Frontend User Upload is a frontend user upload extension plugin. TYPO3 Frontend User Upload has an arbitrary file upload vulnerability that allows remote attackers to exploit the vulnerability to submit a special file and execute it with...

Unrestricted file upload

Unrestricted file upload vulnerability in the Frontend User Upload feupload extension 0.5.0 and earlier for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension using a frontend form, then accessing it via a direct request to the file in the...

CVE-2015-4607

Unrestricted file upload vulnerability in the Frontend User Upload feupload extension 0.5.0 and earlier for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension using a frontend form, then accessing it via a direct request to the file in the...

Arbitrary Code Execution in extension Frontend User Upload (feupload)

It has been discovered that the extension "Frontend User Upload" feupload is susceptible to Arbitrary Code Execution Release Date: June 15, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 0.5.0 and below...

N-Media File Uploader <= 3.7 - Arbitrary File Upload

The Frontend File Manager Plugin WordPress plugin was affected by an Arbitrary File Upload security vulnerability...

SUSE SLED12 / SLES12 Security Update : postgresql93 (SUSE-SU-2015:0478-1)

postgresql93 was updated to version 9.3.6 to fix four security issues. These security issues were fixed : - CVE-2015-0241: Fix buffer overruns in tochar bnc916953. - CVE-2015-0243: Fix buffer overruns in contrib/pgcrypto bnc916953. - CVE-2015-0244: Fix possible loss of frontend/backend protocol...

Shopify: Force 500 Internal Server Error on any shop (for one user)

There is very strange behavior. If user open urls like below: - https://whashp.myshopify.com/?previewthemeid=11288717 - or https://lmfshp.myshopify.com/?previewthemeid=11290937 He got redirect to shop https://whashp.myshopify.com/ and 500 Internal Server Error response, and reload does not help i...

Cross-Site Scripting vulnerability in EMC M&amp;R &#40;Watch4net&#41; Alerting Frontend

------------------------------------------------------------------------ Cross-Site Scripting vulnerability in EMC M&R Watch4net Alerting Frontend ------------------------------------------------------------------------ Han Sahin, November 2014...

EMC M&R (Watch4net) Alerting Frontend XSS

------------------------------------------------------------------------ Cross-Site Scripting vulnerability in EMC M&R Watch4net Alerting Frontend ------------------------------------------------------------------------ Han Sahin, November 2014...

OpenKM Cross-Site Scripting Vulnerability

OpenKM is a document management system from OpenKM Spain. The system provides features such as version control, document history and file sharing. A cross-site scripting vulnerability exists in OpenKM version 6.4.18 build 23338, which stems from a frontend/index.jsp script that fails to adequatel...

CVE-2014-9017

Cross-site scripting XSS vulnerability in OpenKM before 6.4.19 build 23338 allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to frontend/index.jsp...

Authentication Bypass in TYPO3 CMS 4.5

It has been discovered that TYPO3 CMS 4.5.x is vulnerable to Authentication Bypass. Component Type: TYPO3 CMS Vulnerability Types: Authentication Bypass Overall Severity: Critical Release Date: February 19, 2015 Bulletin Update: February 23, 2015 added CVE Vulnerable subcomponent: rsaauth system...

Important Security-Bulletin Pre-Announcement

A TYPO3 4.5.40 release containing a security fix will be published the day after tomorrow, Thursday 19th of February at about 10:00 am CET. The TYPO3 security team has identified a critical security issue in the TYPO3 v4 Core. The following branches are affected by the vulnerability: TYPO3 4.3...

Cross site scripting

Cross-site scripting XSS vulnerability in the frontend interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-100034

Cross-site scripting XSS vulnerability in the frontend interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Code injection

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via...

CVE-2014-9508

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via...