5217 matches found
Design/Logic Flaw
The tweetinfo function in class/functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloading serialized data, which allows man-in-the-middle attackers to conduct PHP object injection attacks and execute arbitrary PHP code by...
CVE-2015-6828
The tweetinfo function in class/functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloading serialized data, which allows man-in-the-middle attackers to conduct PHP object injection attacks and execute arbitrary PHP code by...
CVE-2015-6828: Improper Input Validation
The tweetinfo function in class/functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloading serialized data, which allows man-in-the-middle attackers to conduct PHP object injection attacks and execute arbitrary PHP code by...
PT-2015-7380
Name of the Vulnerable Software and Affected Versions SecureMoz Security Audit plugin version 1.0.5 and earlier Description The issue concerns the tweet info function in the class/ functions.php file, which does not utilize an HTTPS session for downloading serialized data. This oversight allows...
Anchor CMS PHP Object Injection Vulnerability
Exploit for php platform in category web applications CVE-2015-5687 PHP Object Injection in AnchorCMS ================================================= Out of the box, AnchorCMS defaults to store all session state in a cookie contrast this with only storing a unique identifier in a cookie which...
eFront < 3.6.15.4 Build 18023 Multiple Vulnerabilities
According to its version number, the version of eFront running on the remote web server is affected by multiple vulnerabilities : - A path traversal vulnerability exists due to improper sanitization of user-supplied input to the 'file' parameter of the viewfile.php script. A remote attacker can...
CVE-2015-2945
mt-phpincgi.php in Hajime Fujimoto mt-phpincgi before 2015-05-15 does not properly restrict URLs, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request, as exploited in the wild in May 2015...
Design/Logic Flaw
mt-phpincgi.php in Hajime Fujimoto mt-phpincgi before 2015-05-15 does not properly restrict URLs, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request, as exploited in the wild in May 2015...
CVE-2015-2945
The mt-phpincgi script, used to run Movable Type templates as PHP, contains a PHP object injection vulnerability in versions prior to the 2015-05-15 security update. The root cause is an insufficient restriction on URLs, which allows unauthenticated remote attackers to submit a crafted request to...
CVE-2015-2945
mt-phpincgi.php in Hajime Fujimoto mt-phpincgi before 2015-05-15 does not properly restrict URLs, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request, as exploited in the wild in May 2015...
CVE-2015-2945: Improper Control of Generation of Code
mt-phpincgi.php in Hajime Fujimoto mt-phpincgi before 2015-05-15 does not properly restrict URLs, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request, as exploited in the wild in May 2015...
VulnCheck KEV: CVE-2015-2945
mt-phpincgi.php in Hajime Fujimoto mt-phpincgi before 2015-05-15 does not properly restrict URLs, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request, as exploited in the wild in May 2015...
JVN#64459670: mt-phpincgi vulnerable to PHP object injection
mt-phpincgi is script that runs Movable Type templates as PHP. mt-phpincgi contains a PHP object Injection vulnerability. According to the reporter, attacks that attempt to exploit this vulnerability have been confirmed. Impact Arbitrary PHP code may be executed on the server by an unauthenticate...
Forma LMS 1.3 Multiple PHP Object Injection Vulnerabilities
Exploit for php platform in category web applications Forma LMS 1.3 Multiple SQL Injections + Author: Filippo Roncari + Target: Forma LMS + Version: 1.3 and probably lower + Vendor: http://www.formalms.org + Accessibility: Remote + Severity: High + CVE: + Full Advisory:...
Forma LMS 1.3 - Multiple PHP Object Injection Vulnerabilities
Forma LMS 1.3 Multiple PHP Object Injection Vulnerabilities + Author: Filippo Roncari + Target: Forma LMS + Version: 1.3 and probably lower + Vendor: http://www.formalms.org + Accessibility: Remote + Severity: High + CVE: + Full Advisory:...
eFront 3.6.15 PHP Object Injection
eFront 3.6.15 PHP Object Injection Vulnerability + Author: Filippo Roncari + Target: eFront + Version: 3.6.15 and probably lower + Vendor: www.efrontlearning.net + Accessibility: Remote + Severity: High + CVE: + Full Advisory: https://www.securenetwork.it/docs/advisory/SN-15-02eFront.pdf + Info:...
Moodle < 2.4 / 2.4.x < 2.4.11 / 2.5.x < 2.5.7 / 2.6.x < 2.6.4 / 2.7.x < 2.7.1 Multiple Vulnerabilities
Binary data 8723.prm...
Design/Logic Flaw
eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the 1 addrfields or 2 trans parameter to addressbook/csvimport.php, 3 calfields or 4 trans parameter to calendar/csvimport.php, 5...
CVE-2014-2027
eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the 1 addrfields or 2 trans parameter to addressbook/csvimport.php, 3 calfields or 4 trans parameter to calendar/csvimport.php, 5...
CVE-2014-2027
eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the 1 addrfields or 2 trans parameter to addressbook/csvimport.php, 3 calfields or 4 trans parameter to calendar/csvimport.php, 5...