CVE-2016-3196

Cross-site scripting XSS vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section...

GRR Système de Gestion et de Réservations de Ressources 3.0.0-RC1 - Arbitrary File Upload

Exploit for php platform in category web applications Exploit Title: GRR = 3.0.0-RC1 all versions RCE with privilege escalation through file upload filter bypass authenticated Date: January 7th, 2016 Exploit Author: kmkz Bourbon Jean-marie | @kmkzsecurity Vendor Homepage: http://grr.devome.com/fr...

WordPress CodeCanyon Real3D FlipBook 2.18.8 File Deletion / Upload / XSS

1 Unauthenticated file/directory deletion Vulnerability exists in a file 'includes/process.php' where the user input eventually goes to PHP unlink or rmdir functions. We can give any file path or directory here. We can even delete the whole wordpress site. In my POC exploit, I'm just deleting the...

WordPress Plugin Real3D FlipBook - Multiple Vulnerabilities

WordPress Plugin Real3D FlipBook - Multiple Vulnerabilities + POCExploit CodeCanyon Real3D FlipBook WordPress Plugin + http://codecanyon.net/item/real3d-flipbook-wordpress-plugin/6942587 + Multiple Vulnerabilities Found by: Mukarram Khalid +...

Real3D FlipBook <= 2.8 - Multiple Vulnerabilities

List of vulnerabilities: - Delete any file or directory from the server Unauthenticated - Upload images in Root directory Unauthenticated - Cross-Site Scripting XSS + POCExploit CodeCanyon Real3D FlipBook WordPress Plugin + http://codecanyon.net/item/real3d-flipbook-wordpress-plugin/6942587 +...

Paragon Initiative Enterprises: Stored XSS using SVG

Hi , Background ------------------------------------ I had problem in setup the airship at ubuntu so I tested on your site . If you uploads any file thet can use for XSS HTML,SWF,etc the content type will change to "text/plain; charset=us-ascii" . But for images it will stay the same . so if you...

WordPress Levo-Slideshow 2.3 Cross Site Scripting

Document Title: =============== Wordpress Levo-Slideshow v2.3 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1855 Release Date: ============= 2016-06-06 Vulnerability Laboratory ID VL-ID: ====================================...

ImageMagick Remote Code Execution Vulnerability

ImageMagick is an open source software for creating, editing, and composing images. It can read, convert, and write images in many formats, adheres to the GPL license agreement, and runs on most operating systems. A remote code execution vulnerability exists in ImageMagick. An attacker can exploi...

Wordpress 4.5.1 Remote Command Execute

来源 http://ricterz.me/,格式稍作整理 ImageMagick ImageMagick 昨天曝出 CVE-2016-3714，Java、PHP 的库也受其影响可参考 https://www.seebug.org/vuldb/ssvid-91446 。其中 PHP 的库 Imagick 应用广泛，波及也大。Wordpress 也就是受此漏洞影响出现了 RCE。 这个漏洞很蠢，ImageMagick 在 MagickCore/constitute.c 的 ReadImage 函数中解析图片，如果图片地址是https://开头的，即调用 InvokeDelegate。...

iScripts EasyCreate Remote Code Execution Vulnerability

iScripts EasyCreate is an online website builder that can be used on a server to provide website building services to clients and is fully customizable. A remote code execution vulnerability exists in iScripts EasyCreate. The 'userImages' POST parameter of the '/ajaximageupload.php' script fails ...

UBUNTU-CVE-2016-0757

OpenStack Image Service Glance before 2015.1.3 kilo and 11.0.x before 11.0.2 liberty, when showmultiplelocations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image...

Urban Dictionary: Cross-Site Scripting Vulnerability in urbandictionary.com

User can upload image for any definition available in urbandictionary.com. If anyone upload Invalid image file then you return a message through a url like this http://www.urbandictionary.com/cloudinarycors.html?error=Invalid+image+file Here the error parameter is vulnerable to xss. Impact When a...

iScripts EasyCreate 3.0 - Remote Code Execution

!C:/Python27/python.exe -u iScripts EasyCreate 3.0 Remote Code Execution Exploit Vendor: iScripts.com Product web page: http://www.iscripts.com Affected version: 3.0 Summary: iScripts EasyCreate is a private label online website builder. This software allows you to start an online business by...

iScripts EasyCreate 3.0 Remote Code Execution

!C:/Python27/python.exe -u iScripts EasyCreate 3.0 Remote Code Execution Exploit Vendor: iScripts.com Product web page: http://www.iscripts.com Affected version: 3.0 Summary: iScripts EasyCreate is a private label online website builder. This software allows you to start an online business by...

Grawlix 1.0.3 Code Execution

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Grawlix 1.0.3 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://www.getgrawlix.com/ Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to vendor: 11/17/2015 Disclosed to public: 12/21/201...

Lithium Forum Cross Site Scripting

Document Title: =============== Lithium Forum - previewImages Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1520 Release Date: ============= 2015-12-18 Vulnerability Laboratory ID VL-ID: ==================================== 152...

TomatoCart 1.1.8.6.1 Shell Upload

Security Advisory - Curesec Research Team 1. Introduction Affected Product: TomatoCart v1.1.8.6.1 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to vendor: 09/29/2015 Disclosed to public:...

X (Formerly Twitter): File Upload XSS in image uploading of App in mopub

Hi Team, I want to report a File upload XSS in your Image upload functionality of Apps in mopub. Server doesn't check whether you are uploading a jpg/jpeg files and it upload the file on image.mopub.com . POC link : https://images.mopub.com/appicons/126cb3308e1a464385a49c4c7aaeac56 Steps to...

Shopify: SVG parser loads external resources on image upload

Uploading SVG that include will cause the server side parser to try to fetch external resources. I've tested in two ways. Creating an svg with an external loaded public google image that was rendered perfectly. Also tested a private server with nc and created an svg that uses xlink for private ur...

CVE-2015-7904

Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file...