PT-2012-6057

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.9 ownCloud versions 4.5.x prior to 4.5.2 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a file with a specially crafted name due to an incomplete blacklist...

PT-2012-6056

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.5.2 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP file. This is due to an incomplete blacklist vulnerability in lib/migrate.php...

CVE-2012-5610: Improper Input Validation

Incomplete blacklist vulnerability in lib/filesystem.php in ownCloud before 4.0.9 and 4.5.x before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a special crafted name...

CVE-2012-5450

Cross-site request forgery CSRF vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter...

PT-2012-6252

Name of the Vulnerable Software and Affected Versions CMS Made Simple versions prior to 1.11.2.1 Description A directory traversal issue exists, allowing remote authenticated administrators to delete arbitrary files by utilizing a .. dot dot in the deld parameter. This can be exploited using CSRF...

CVE-2012-5450: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter...

Network Shutdown Module 3.21 Remote PHP Code Injection

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'msf/core/exploit/phpexe' class Metasploit3...

CVE-2012-5472

lib/formslib.php in Moodle 2.2.x before 2.2.6 and 2.3.x before 2.3.3 allows remote authenticated users to bypass intended access restrictions via a modified value of a frozen form field...

CVE-2012-5472: Undefined Security Weakness

lib/formslib.php in Moodle 2.2.x before 2.2.6 and 2.3.x before 2.3.3 allows remote authenticated users to bypass intended access restrictions via a modified value of a frozen form field...

PT-2012-5988

Name of the Vulnerable Software and Affected Versions Moodle versions 2.2.x through 2.2.5 Moodle versions 2.3.x through 2.3.2 Description The issue allows remote authenticated users to bypass intended access restrictions. This is achieved by modifying the value of a frozen form field in...

CVE-2012-4533: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the "extra" details in the DiffSource.getrow function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" lin...

CVE-2012-4533

Cross-site scripting XSS vulnerability in the "extra" details in the DiffSource.getrow function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" lin...

PT-2012-6183

Name of the Vulnerable Software and Affected Versions DFLabs PTK version 1.0.5 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the arg4 parameter in the ptk/lib/modal bookmark.php file. Recommendations For DFLabs PTK versio...

CVE-2012-4505: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the pxpacreload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than CVE-2012-4504...

Low: puppet

Issue Overview: Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a...

CVE-2012-4407

lib/filelib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly check the publication state of blog files, which allows remote attackers to obtain sensitive information by reading a blog entry that references a non-public file...

CVE-2012-4407: Exposure of Sensitive Information to an Unauthorized Actor

lib/filelib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly check the publication state of blog files, which allows remote attackers to obtain sensitive information by reading a blog entry that references a non-public file...

PT-2012-5380

Name of the Vulnerable Software and Affected Versions Moodle versions 2.1.x through 2.1.7 Moodle versions 2.2.x through 2.2.4 Moodle versions 2.3.x through 2.3.1 Description The issue allows remote attackers to obtain sensitive information by reading a blog entry that references a non-public file...

CVE-2012-2275

Multiple cross-site request forgery CSRF vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to...

PT-2012-3914

Name of the Vulnerable Software and Affected Versions TestLink versions 1.9.3 and earlier Description The issue allows remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information. This can be demonstrated by changing the administrator's...