Insecure Direct Object Reference

The following URL is vulnerable to Insecure Direct Object Reference, allowing any authenticated user to read configuration files from the application such as the content of webapp directory in confluence. http:///spaces/viewdefaultdecorator.action?decoratorName=...

WordPress Plugin Ajax Load More < 2.8.2 - Arbitrary File Upload

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'WordPress Plugin ajax-load-more Authenticated Arbitrary File Upload', 'Description' = %q This module exploits an authenticated...

Wordpress Ajax Load More Plugin < 2.8.2 - File Upload Vulnerability

Exploit for php platform in category web applications This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'WordPress Plugin ajax-load-more Authenticated Arbitrary File Upload',...

WordPress Ajax Load More Plugin < 2.8.2 - File Upload

This vulnerability allows an attacker to upload arbitrary files to the affected computer. Solution Upgrade the plugin...

Ajax Load More <= 2.8.1.1 - Authenticated File Upload & Deletion

Authenticated file upload in file ajax-load-more/admin/admin.php file, in the function almsaverepeater. The variable $f is set to a predictable PHP file path, and then the content of the variable $c is written into that file. The following code proves that this second variable is also set from...

Wordpress Ajax Load More PHP Upload Vulnerability

This module exploits an arbitrary file upload in the WordPress Ajax Load More version 2.8.1.1. It allows to upload arbitrary php files and get remote code execution. This module has been tested successfully on WordPress Ajax Load More 2.8.0 with Wordpress 4.1.3 on Ubuntu 12.04/14.04 Server. Modul...

Android Security Restriction Bypass Vulnerability (CNVD-2015-06576)

Android is an operating system based on the Linux open kernel, announced on November 5, 2007 by Google Inc. for cell phones. A security restriction bypass vulnerability exists in LMY48I, a version of Android prior to 5.1.1. Allows an attacker to trigger a faulty process load via a crafted...

LXC Elevation of Privilege Vulnerability

LXC LinuX Containers is a user-space interface to the Linux kernel's container functionality that makes it easy for Linux users to create and manage system or application containers with a powerful API and simple tools. An elevation of privilege vulnerability exists in LXC versions prior to 1.0.8...

Apple OS X eSCL Message Handling Vulnerability

Apple OS X is an operating system developed by Apple Inc. Apple OS X suffers from a security vulnerability in the handling of eSCL messages that allows remote users who can listen to the network to extract load information...

Apple OS X Address Book Handling Vulnerability

Apple OS X is an operating system developed by Apple Inc. A security vulnerability in the Apple OS X address book handling environment variable allows local users to exploit the vulnerability to inject arbitrary code into the jinx to load the address book architecture...

Python for Windows may insecurely load dynamic libraries

Overview Python for Windows contains an issue with the DLL search path, which may lead to insecurely loading a DLL called readline.pyd. Takashi Yoshikawa of Mitsui Bussan Secure Directions reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Earl...

IRCCloud: Inadequate input validation on API endpoint leading to self denial of service and increased system load.

Summary A security researcher discovered an API payload that would send invalid data to their own user process, which would repeatedly fail to be handled correctly. This error handling loop prevented further access to their user account. Details The payload was a JSON object containing an empty...

JasPer 'jasper_image_stop_load()' function denial of service vulnerability

JasPer is an open source implementation of the JPEG-2000 codec . A security vulnerability in the JasPer 'jasperimagestopload' function for processing JPG files allows attackers to exploit the vulnerability to crash the application...

RHEL 6 / 7 : haproxy 1.5 (RHSA-2015:1741)

An updated haproxy package that fixes one security issue is now available for Red Hat Enterprise Linux 6 and 7. HAProxy provides high availability, load balancing, and proxying for TCP and HTTP-based applications. An implementation error related to the memory management of request and responses w...

Photon vulnerable to URL whitelist bypass

Overview Photon provided by Newphoria Corporation Inc. is an application for Android built using "applican". Photon contains an issue where an arbitrary page may be loaded if the application is launched using the URL-scheme. Kenta Suefusa and Tomonori Shiomi of Sprout Inc. reported this...

Reversi vulnerable to URL whitelist bypass

Overview Reversi provided by Newphoria Corporation Inc. is an application for both iOS or Android built using "applican". Reversi contains an issue where an arbitrary page may be loaded if the application is launched using the URL-scheme. Kenta Suefusa and Tomonori Shiomi of Sprout Inc. reported...

IBM WebSphere Portal Denial of Service Vulnerability (CNVD-2015-06033)

IBM WebSphere Portal is a suite of enterprise portal software from IBM. The software creates a platform that connects an organization internally and externally, allowing employees, customers and suppliers to access internal data through the platform. A denial of service vulnerability exists in IB...

PHP 5.5.9 - zend_executor_globals CGIMode FPM WriteProcMemFile Disable Functions Bypass Load Dynamic Library

PHP 5.5.9 - zendexecutorglobals CGIMode FPM WriteProcMemFile Disable Functions Bypass Load Dynamic Library ?php // EDB Note: Paper https://www.exploit-db.com/docs/english/38104-shoot-zendexecutorglobals-to-bypass-php-disablefunctions.pdf errorreporting0x66778899; settimelimit0x41424344;...

PHP 5.5.9 - zend_executor_globals CGIMode FPM WriteProcMemFile disable_functions Bypass Load Dynamic Library

PHP 5.5.9 - zendexecutorglobals CGIMode FPM WriteProcMemFile disablefunctions Bypass Load Dynamic Library ?php // EDB Note: Paper https://www.exploit-db.com/docs/english/38104-shoot-zendexecutorglobals-to-bypass-php-disablefunctions.pdf errorreporting0x66778899; settimelimit0x41424344;...

CentOS Update for haproxy CESA-2015:1741 centos7

Check the version of haproxy SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882283";...