CVE-2014-6231

CVE-2014-6231 concerns the CWT Frontend Edit (cwt_feedit) TYPO3 extension. The connected TYPO3 Security Bulletin (TYPO3-EXT-SA-2014-010) lists affected versions 1.2.4 and earlier and identifies Arbitrary Code Execution as the vulnerability type, with a critical severity. The exact exploit vectors...

CVE-2014-6231

Unspecified vulnerability in the CWT Frontend Edit cwtfeedit extension before 1.2.5 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors...

ntopng 1.2.0 - XSS Vulnerability

ntopng version 1.2.0 suffers from a cross site scripting vulnerability using monitored network traffic. ntopng 1.2.0 XSS injection using monitored network traffic ntopng is the next generation version of the original ntop, a network traffic probe and monitor that shows the network usage, similar ...

[SECURITY] [DSA 2970-1] cacti security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2970-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 29, 2014 http://www.debian.org/security/faq -...

PHPOK 存储型 xss两处

简要描述： 前台功能存在存储型 xss，可攻击后台，获取管理员权限。 详细说明： 第一处xss漏洞： 留言功能。 后台的输出点有一处输出如下： 可以看出，我们留言的标题直接输出在 onclick 事件中了，可简单构造 '+alert1+'，管理员删除留言时触发： 此时输出： 第二处xss漏洞： PHPOK 过滤 XSS 的函数如下： function safehtml$info if!$info return false; $tmp = "//isU"; $info = pregreplace$tmp,"",$info; //$info =...

ntopng 1.2.0 - Cross-Site Scripting Injection

ntopng 1.2.0 XSS injection using monitored network traffic ntopng is the next generation version of the original ntop, a network traffic probe and monitor that shows the network usage, similar to what the popular top Unix command does. The web-based frontend of the software is vulnerable to...

N-Media File Uploader < 2.0 Arbitrary File Upload

The Frontend File Manager Plugin WordPress plugin was affected by security vulnerability...

cacti security update

Package : cacti Version : 0.8.7g-1+squeeze4 CVE ID : CVE-2014-2326 CVE-2014-2327 CVE-2014-2328 CVE-2014-2708 CVE-2014-2709 CVE-2014-4002 Debian Bug : 742768 743565 752573 Multiple security issues cross-site scripting, cross-site request forgery, SQL injections, missing input sanitising have been...

Wordpress Frontend Upload Plugin - Arbitrary File Upload

No description provided by source...

BASE <= 1.2.4 melissa (Snort Frontend) Remote Inclusion Vulnerabilities

No description provided by source. Basic Analysis and Security Engine BASE = 1.2.4 melissa Inclusion Vulnerabilities Just glanced over BASE for a pentesting job. /str0ke ! milw0rm.com code baseqrycommon.php includeonce$BASEpath/includes/basesignature.inc.php; /code...

Dyncms <= Release 6 (x_admindir) Remote File Include Vulnerability

No description provided by source. ============================================================================================== Dyn CMS = REleased xadmindir Remote File Inclusion Exploit =============================================================================================== Critical Lev...

AWBS 2.9.2 (cart.php) Blind SQL Injection Vulnerability

No description provided by source. AWBS 2.9.2 Blind SQL Injection 0day ============================================================================================= Dork....: inurl:/cart?ca=addother&oid= Date....: 01-16-2011 Author..: ShivX Contact.: shivanxatgmaildotcom Vendor..:...

phpwcms <= 1.5.4.6 "preg_replace" - Multiple Vulnerabilities

No description provided by source. ?php / phpwcms = v1.5.4.6 pregreplace remote code execution exploit vendor: http://www.phpwcms.de/ Download: github.com/slackero/phpwcms by: aeon Well it appears there are multiple remote code execution bugs that exists in phpwcms for quite some time now. Here I...

Debian: Security Advisory (DSA-2970-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FineCMS v2.3.0一处xss可x前台用户后台管理，专业盲打管理！#2

简要描述： 呵呵 详细说明： 本地测试 会员中心-新闻-发布主题-主题名插入xss代码 发布新闻不需要审核的，正好方便我们x前台用户 查看主题 用google浏览器登录后台看看 查看源代码 漏洞证明： 求rank 啊！！之前的漏洞求审核啊啊！！...

[SECURITY] Fedora 20 Update: python-fmn-web-0.2.4-3.fc20

fmn is a family of systems to manage end-user notifications triggered by fedmsg, the Fedora FEDerated MESsage bus. This module contains the frontend web application for Fedora Notifications...

CVE-2014-1685

The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors...

DEBIAN-CVE-2014-1685

The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors...

CVE-2014-1685

The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors...

Design/Logic Flaw

The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors...