WiFi File Browser Pro v2.0.8 - Code Execution Vulnerability

WiFi File Browser Pro version 2.0.8 suffers from a code execution vulnerability. Product & Service Introduction: =============================== WiFi File Browser allows you to download and upload files to your mobile device by using your favourite web browser without the need of a USB cable. The...

CatBot v0.4.2 (PHP) - SQL Injection Vulnerability

Document Title: =============== CatBot v0.4.2 PHP - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1408 Release Date: ============= 2015-01-15 Vulnerability Laboratory ID VL-ID: ==================================== 1408 Commo...

Guest Files Restore Missing Drive Using Storage Spaces

Veeam Explorer Appliancation Item Restores Some Application Item Restores use Guest Files Restore on the backend to mount the VM's Guest OS disks and access their contents to perform the application item restore. If the files needed to perform the application item restore are located on a Storage...

WiFi File Browser Pro v2.0.8 - Code Execution Vulnerability

Document Title: =============== WiFi File Browser Pro v2.0.8 - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1406 Release Date: ============= 2015-01-14 Vulnerability Laboratory ID VL-ID: ===================================...

WordPress Welcart e-Commerce Plugin <= 1.3.12 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML in an adddeliverymethod action to wp-admin/admin-ajax.php via 4 parameters: "name", "intl", "nocod", or "time parameter". Solution Update the plugin...

FreeBSD : OpenSSL -- multiple vulnerabilities (4e536c14-9791-11e4-977d-d050992ecde8) (FREAK)

OpenSSL project reports : DTLS segmentation fault in dtls1getrecord CVE-2014-3571 DTLS memory leak in dtls1bufferrecord CVE-2015-0206 no-ssl3 configuration sets method to NULL CVE-2014-3569 ECDHE silently downgrades to ECDH Client CVE-2014-3572 RSA silently downgrades to EXPORTRSA Client...

CVE-2014-8083

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action...

CVE-2014-8083

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action...

Google found Windows 8.1 0day vulnerabilities and published vulnerabilities verify program PoC-the exploit-warning-the black bar safety net

Google security researcher found a Windows 8.1 privilege escalation vulnerability, the attacker can use the vulnerability to modify the system content and even completely control the victim computer. Currently Google has announced a vulnerability in the authentication program, the PoC Airport. Po...

PHP 5.5.x < 5.5.20 'process_nested_data' RCE

According to its banner, the version of PHP 5.5.x installed on the remote host is prior to 5.5.20. It is, therefore, affected by a use-after-free error in the 'processnesteddata' function within 'ext/standard/varunserializer.re' due to improper handling of duplicate keys within the serialized...

PHP 5.4.x < 5.4.36 'process_nested_data' RCE

According to its banner, the version of PHP 5.4.x installed on the remote host is prior to 5.4.36. It is, therefore, affected by a use-after-free error in the 'processnesteddata' function within 'ext/standard/varunserializer.re' due to improper handling of duplicate keys within the serialized...

CVE-2011-5295

Buffer overflow in the Download method in a certain ActiveX control in MDIEEx.dll in Gogago YouTube Video Converter 1.1.6 allows remote attackers to execute arbitrary code via a long argument...

Code injection

The SaveMessage method in the LEADeMail.LEADSmtp.20 ActiveX control in LTCML14n.dll 14.0.0.34 in Kofax e-Transactions Sender Sendbox 2.5.0.933 allows remote attackers to write to arbitrary files via a pathname in the first argument...

Buffer overflow

Buffer overflow in the Download method in a certain ActiveX control in MDIEEx.dll in Gogago YouTube Video Converter 1.1.6 allows remote attackers to execute arbitrary code via a long argument...

CVE-2011-5295

Affected product: Gogago YouTube Video Converter, version 1.1.6. The issue is a buffer overflow in the MDIEEx.dll ActiveX control’s Download method, allowing remote code execution via a long argument. This vulnerability is reported consistently across multiple sources (NVD, Red Hat, CNVD, CVE lis...

CVE-2011-5293

The cmdSave method in the ThreeDify.ThreeDifyDesigner.1 ActiveX control in ActiveSolid.dll in ThreeDify Designer 5.0.2 allows remote attackers to write to arbitrary files via a pathname in the argument...

Design/Logic Flaw

The SaveData method in the Cygnicon.ViewControl.1 ActiveX control in CyViewer.ocx in Ashampoo 3D CAD Professional 3.x before 3.0.2 allows remote attackers to write to arbitrary files via a pathname in the first argument...

CVE-2011-5291

The SaveData method in the Cygnicon.ViewControl.1 ActiveX control in CyViewer.ocx in Ashampoo 3D CAD Professional 3.x before 3.0.2 allows remote attackers to write to arbitrary files via a pathname in the first argument...

CVE-2011-5291

The CVE-2011-5291 entry concerns Ashampoo 3D CAD Professional (3.x) before 3.0.2, where the SaveData method of the Cygnicon.ViewControl.1 ActiveX control in CyViewer.ocx allows a remote attacker to write arbitrary files by supplying a pathname as the first argument. The vulnerability is rooted in...

CVE-2011-5290

Technical summary (CVE-2011-5290): The vulnerability affects IDrive Online Backup 3.4.0, specifically the UniBasic100_EDA1811C.ocx’s UniBasicPack.UniTextBox ActiveX control. The SaveToFile method can be abused to write to arbitrary files by supplying a pathname as the first argument. This is a re...