5469 matches found
CVE-2014-2922: Improper Input Validation
The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors...
CVE-2014-2921: Improper Control of Generation of Code
The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via...
PT-2014-4958
Name of the Vulnerable Software and Affected Versions pimcore versions 1.4.9 through 2.1.0 Description The issue concerns the getObjectByToken function in Newsletter.php within the Pimcore Tool Newsletter module. It fails to properly handle an object obtained by unserializing a pathname, allowing...
PT-2014-4957
Name of the Vulnerable Software and Affected Versions pimcore versions 1.4.9 through 2.0.0 Description The issue concerns the getObjectByToken function in the Pimcore Tool Newsletter module, which does not properly handle objects obtained from unserializing Lucene search data. This allows remote...
PT-2015-3697
Name of the Vulnerable Software and Affected Versions eGroupware versions prior to 1.8.006.20140217 Description The issue allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code. This can be achieved via several parameters to...
Egroupware 1.8.005 PHP Object Insertion
Vulnerabilities in EGroupware 1.8.005 Discovered by Pedro Ribeiro [email protected] of Agile Information Security ==================================================================== Vulnerability: PHP object insertion leading to all kinds of badness arbitrary file deletion, possible code executio...
PHP object injection vulnerability allows for arbitrary code execution
More info at https://contao.org/en/news/major-security-hole-found-in-contao.html...
Contao CMS 3.2.4 Code Execution Vulnerability
Contao CMS versions 3.2.4 and below suffer from a code execution vulnerability. Hi, I have discovered a vulnerability that might lead to code execution in Contao CMS Vulnerabilities in Contao 3.2.4 Discovered by Pedro Ribeiro email protected of Agile Information Security...
Security feature bypass
The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 before 3.6.13.1 and 3.8.9 before 3.8.9.1 does not properly validate login data in HTTP Cookie headers, which allows remote attackers to conduct PHP object...
CVE-2013-5350
The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 before 3.6.13.1 and 3.8.9 before 3.8.9.1 does not properly validate login data in HTTP Cookie headers, which allows remote attackers to conduct PHP object...
CVE-2013-5350
The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 before 3.6.13.1 and 3.8.9 before 3.8.9.1 does not properly validate login data in HTTP Cookie headers, which allows remote attackers to conduct PHP object...
CVE-2013-5350
The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 before 3.6.13.1 and 3.8.9 before 3.8.9.1 does not properly validate login data in HTTP Cookie headers, which allows remote attackers to conduct PHP object...
CVE-2013-5350
OpenPNE contains a PHP Object Injection vulnerability in opSecurityUser.getRememberLoginCookie() that processes cookies with unserialize(base64_decode()) without proper input filtering. A remote unauthenticated attacker could craft a serialized object in a Cookie header to execute arbitrary PHP c...
JVN#69986880: OpenPNE vulnerable to PHP Object Injection
OpenPNE contains an issue in processing Cookie headers, which may result in a PHP Object Injection vulnerability. Impact A remote, unauthenticated attacker may execute an arbitrary PHP code. Solution Apply an update Update to the latest version according to the information provided by the...
PT-2014-2909
Name of the Vulnerable Software and Affected Versions OpenPNE versions 3.6.13 through 3.6.13 OpenPNE versions 3.8.9 through 3.8.9 Description The issue concerns the "Remember me" feature, which does not properly validate login data in HTTP Cookie headers. This allows remote attackers to conduct P...
CVE-2013-5350: Improper Input Validation
The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 before 3.6.13.1 and 3.8.9 before 3.8.9.1 does not properly validate login data in HTTP Cookie headers, which allows remote attackers to conduct PHP object...
LiveZilla 5.1.2.0 PHP Object Injection
Author: Jakub Zoczek [email protected] CVE Reference: CVE-2013-7034 Product: LiveZilla Vendor: LiveZilla GmbH http://livezilla.net Affected version: 5.1.2.0 Severity: Medium CVSSv2 Score: 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N Status: Fixed 0x01 Background LiveZilla, the widely-used and trusted Live Help...
Vanilla Forums 2.0 - 2.0.18.5 PHP Object Injection Vulnerability
Exploit for php platform in category web applications ------------------------------------------------------------------------------------------- Vanilla Forums ValidateTransientKey$TransientKey 324. // If messages wasn't empty 325. if $Messages != '' 326. // Unserialize them & save them if...
Vanilla Forums 2.0 < 2.0.18.5 - 'class.utilitycontroller.php' PHP Object Injection
------------------------------------------------------------------------------------------- Vanilla Forums ValidateTransientKey$TransientKey 324. // If messages wasn't empty 325. if $Messages != '' 326. // Unserialize them & save them if necessary 327. $Messages = GdnFormat::Unserialize$Messages;...
[KIS-2013-09] Vanilla Forums <= 2.0.18.5 (class.utilitycontroller.php) PHP Object Injection Vulnerability
------------------------------------------------------------------------------------------- Vanilla Forums = 2.0.18.5 class.utilitycontroller.php PHP Object Injection Vulnerability ------------------------------------------------------------------------------------------- - Software Link:...