CVE-2015-7904

Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file...

UBUNTU-CVE-2015-5286

OpenStack Image Service Glance before 2014.2.4 juno and 2015.1.x before 2015.1.2 kilo allows remote authenticated users to bypass the storage quota and cause a denial of service disk consumption by deleting images that are being uploaded using a token that expires during the process. NOTE: this...

FanFootage: XSS by image file name

Hello, An XSS can be triggered if the user uploaded an image with an XSS vector as the file name, See the screenshot for more info, Thanks...

wordpress vertical image slider plugin < 1.2 - Cross-Site Scripting & CSRF

The lack of CSRF check and sanitisation could allow attackers to perform Cross-Site Scripting attack against logged in administrator, as well as upload arbitrary files XSS via CSRF: alert"XSS"' alert"XSS"' setTimeout'form1.submit', 1; Upload file via CSRF:...

WordPress Vertical Image Slider 1.0 CSRF / XSS Vulnerabilities

Exploit for php platform in category web applications Exploit Title : Wordpress Vertical image slider CSRF/XSS Exploit Author: Ashiyane Digital Security Team Vendor Homepage: https://wordpress.org/plugins/wp-vertical-image-slider/ Software Link:...

NibbleBlog 4.0.3 Shell Upload

NibbleBlog 4.0.3: Code Execution Security Advisory – Curesec Research Team 1. Introduction Affected Product: NibbleBlog 4.0.3 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: Website: http://www.nibbleblog.com/ Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to...

Thumbnail Carousel Slider < 1.0.1 - Authenticated Shell Upload & CSRF

The original advisory states that this vulnerability is exploitable with editor and author roles but this is incorrect. Only the administrator role by default can trigger this vulnerability. However, CSRF on the image upload form makes this exploitable by a malicious actor. PoC Create a file name...

thinksaas最新版存储xss

简要描述： 过滤不当 详细说明： 最新版下载地址http://www.thinksaas.cn/service/down/ 跟前面thinksaas最新版xss2 WooYun: thinksaas最新版xss2 thinksaas最新版xss WooYun: thinksaas最新版xss 原理都一样 吐槽下 官网不让注册帐号 就在本地测试了 前人的我测试一个现在还可以 当然 漏洞文件肯定是不一样的 漏洞文件 在app/article/action/add.php 25行中没有过滤 48行插入数据库 isLogin; switch $ts case "" : if...

SDCMS论坛存在高危漏洞可getshell，影响其大量系统

简要描述： shell 详细说明： 论坛存在解析漏洞，可利用该漏洞getshell 漏洞证明： 该论坛为aspx类型的论坛，但还可以做php容器可以执行php文件，且存在php解析漏洞。。然后就没有然后了。。。 找到论坛需要注册码：http://bbs.sdcms.cn/，十块钱一个。。。。 屌丝买不起，找到一个手机号昵称的用户：15837309973，手机号当用户名和密码居然登进去了。。 在头像上传处直接上传一张图片马，找到路径：http://bbs.sdcms.cn/max-temp/avatar/28a1ddde7e6a4ecbaf56e54ad06a3406.jpg...

CVE-2015-1851

OpenStack Cinder before 2014.1.5 icehouse, 2014.2.x before 2014.2.4 juno, and 2015.1.x before 2015.1.1 kilo allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command...

CVE-2015-1851

OpenStack Cinder before 2014.1.5 icehouse, 2014.2.x before 2014.2.4 juno, and 2015.1.x before 2015.1.1 kilo allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command...

Joomla Simple Image Upload 1.0 Shell Upload

Exploit Title: Joomla Simple Image Upload - Arbitrary File Upload Google Dork: inurl:option=comsimpleimageupload Date: 23.06.2015 Exploit Author: CrashBandicot @DosPerl Vendor Homepage: http://tuts4you.de/ Software Link: http://tuts4you.de/96-development/156-simpleimageupload Version: 1.0 Tested...

Joomla! Component com_simpleimageupload - Arbitrary File Upload

Joomla! Component comsimpleimageupload - Arbitrary File Upload Exploit Title: Joomla Simple Image Upload - Arbitrary File Upload Google Dork: inurl:option=comsimpleimageupload Date: 23.06.2015 Exploit Author: CrashBandicot @DosPerl Vendor Homepage: http://tuts4you.de/ Software Link:...

Joomla! Component com_simpleimageupload - Arbitrary File Upload

Exploit Title: Joomla Simple Image Upload - Arbitrary File Upload Google Dork: inurl:option=comsimpleimageupload Date: 23.06.2015 Exploit Author: CrashBandicot @DosPerl Vendor Homepage: http://tuts4you.de/ Software Link: http://tuts4you.de/96-development/156-simpleimageupload Version: 1.0 Tested...

Ebay Magento Bug Bounty #10 - Persistent Vulnerability

Document Title: =============== Ebay Magento Bug Bounty 10 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1457 eBay Inc. Bug Bounty Program ID: EIBBP-31603 Video: https://www.youtube.com/watch?v=WffsHd8pibE Release Date:...

WordPress Plugin Wp-ImageZoom 1.1.0 - Multiple Vulnerabilities

WordPress Plugin Wp-ImageZoom 1.1.0 - Multiple Vulnerabilities Exploit Title: wp-imagezoom Remote Image Upload Google Dork: filetype:php inurl:"/wp-content/plugins/wp-imagezoom" & inurl:"?id=" Date: 06.06.2015 Exploit Author: T3N38R15 Software Link:...

WordPress Plugin Wp-ImageZoom 1.1.0 - Multiple Vulnerabilities

Exploit Title: wp-imagezoom Remote Image Upload Google Dork: filetype:php inurl:"/wp-content/plugins/wp-imagezoom" & inurl:"?id=" Date: 06.06.2015 Exploit Author: T3N38R15 Software Link: https://downloads.wordpress.org/plugin/wp-imagezoom.1.1.0.zip Version: 1.1.0 Tested on: Windows Firefox Linux...

WordPress Another Classifieds Plugin <= 1.8.9.4 - Unspecified Image Upload

This plugin is prone to an unspecified vulnerability. Solution Upgrade the plugin...

Shopify: Stored XSS in the Shopify Discussion Forums

Hi Shopify Security Team, There is Stored XSS in the Shopify Discussion Forums.Under ecommerce.shopify.com, in shopify-discussion The STORED XSS is present. The Stored XSS can easily be produced Every time. To Produce the XSS Vulnerability, I created a New Topic Under the shopify-discussions in t...

openstack-glance: user storage quota bypass

A storage quota bypass flaw was found in OpenStack Image glance. If an image was deleted while it was being uploaded, it would not count towards a user's quota. A malicious user could use this flaw to deliberately fill the backing store, and cause a denial of service...