Sql injection

Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the 1 orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a 2 parameter name starting with...

CVE-2013-1803

PHP-Fusion 7.x is affected by CVE-2013-1803: multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06. The issues allow remote SQL execution via numerous parameters across several scripts (downloads.php; forum/postedit.php; forum/postnewthread.php; administration/settings_messages.php;...

CVE-2013-7375

CVE-2013-7375 is an SQL injection in PHP-Fusion 7.02.01–7.02.05 via the user ID stored in a cookie, affecting Authenticate.class.php. It enables remote attackers to execute arbitrary SQL commands. This entry is separate from CVE-2013-1803 and is corroborated by multiple sources in the connected d...

CVE-2013-7375

SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie, a different vulnerability than CVE-2013-1803...

CVE-2013-1803

Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the 1 orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a 2 parameter name starting with...

Oracle Data Quality and Profiling Client Multiple Vulnerabilities (April 2014 CPU)

According to the version of the Oracle Data Quality and Profiling client installed on the remote host, it is affected by multiple unspecified ActiveX control vulnerabilities. By tricking a user into opening a specially crafted document, an attacker may be able to execute arbitrary code...

CVE-2013-1806

Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. dot dot in the 1 usertheme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the 2 enable...

CVE-2013-1807

PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/dbbackups/...

Directory traversal

PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/dbbackups/...

Directory traversal

Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. dot dot in the 1 usertheme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the 2 enable...

CVE-2013-1806

Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. dot dot in the 1 usertheme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the 2 enable...

CVE-2013-1807

CVE-2013-1807 affects PHP-Fusion, with older builds (before 7.02.06) storing backup files in an unrestricted directory under the web root (administration/db_backups/) using predictable filenames. The vulnerability allows remote attackers to directly request these backup files and potentially obta...

CVE-2013-1807

PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/dbbackups/...

CVE-2013-1806

PHP-Fusion before 7.02.06 has multiple directory traversal vulnerabilities: remote authenticated users can include/execute arbitrary files via .. in user_theme (maincore.php); remote authenticated admins can delete arbitrary files via enable (administration/user_fields.php) or file (administratio...

CVE-2013-1804

Multiple cross-site scripting XSS vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the 1 highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the 1 highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the...

CVE-2013-1804

PHP-Fusion prior to 7.02.06 contains multiple XSS vulnerabilities enabling an attacker to inject arbitrary scripts via numerous parameters (e.g., forum/viewthread.php highlight, messages.php user_list/user_types, shoutbox_admin.php message, administration/news.php message, administration/panel_ed...

CVE-2013-1804

Multiple cross-site scripting XSS vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the 1 highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the...

VMware Fusion 6.x < 6.0.3 OpenSSL Library Multiple Vulnerabilities (VMSA-2014-0004) (Heartbleed)

The version of VMware Fusion 6.x installed on the remote Mac OS X host is prior to 6.0.3. It is, therefore, reportedly affected by the following vulnerabilities in the OpenSSL library : - An error exists related to the implementation of the Elliptic Curve Digital Signature Algorithm ECDSA that...

CVE-2014-2880

Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backUrl parameter in a changepwd action to...