5195 matches found
CVE-2015-8562: Improper Input Validation
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015...
CVE-2015-7808
The vBApiHook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments...
Design/Logic Flaw
The vBApiHook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments...
CVE-2015-7808
The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect versions 5.1.2 through 5.1.9 is vulnerable to PHP object injection . Remote attackers can execute arbitrary PHP code by sending a crafted serialized object via the arguments parameter to the ajax/api/hook/decodeArguments endpoint. Thi...
CVE-2015-7808
The vBApiHook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments...
CVE-2015-7808: Improper Input Validation
The vBApiHook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments...
CVE-2015-7816
The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery SSRF attacks, and execute arbitrary PHP code via a crafted HTTP header...
CVE-2015-7816
The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery SSRF attacks, and execute arbitrary PHP code via a crafted HTTP header...
CVE-2015-7816
The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery SSRF attacks, and execute arbitrary PHP code via a crafted HTTP header...
CVE-2015-7816
CVE-2015-7816 affects Piwik (renamed Matomo) prior to 2.15.0, where the DisplayTopKeywords function in plugins/Referrers/Controller.php allows PHP object injection, Server-Side Request Forgery (SSRF), and arbitrary PHP code execution via a crafted HTTP header. The issue is caused by insecure hand...
CVE-2015-7816: Undefined Security Weakness
The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery SSRF attacks, and execute arbitrary PHP code via a crafted HTTP header...
vBulletin 5.x.x 远程任意代码执行漏洞
unserialize 实战之 vBulletin 5.x.x 远程代码执行 --- Author: RickGray 知道创宇404安全实验室 近日，vBulletin 的一枚 RCE 利用和简要的分析被曝光，产生漏洞的原因源于 vBulletin 程序在处理 Ajax API 调用的时候，使用 unserialize 对传递的参数值进行了反序列化操作，导致攻击者使用精心构造出的 Payload 直接导致代码执行。关于 PHP 中反序列化漏洞的问题可以参考 OWASP 的《PHP Object Injection》。 使用 原文 提供的 Payload 可以直接在受影响的站点上执行...
vBulletin 5.1.2 Unserialize Code Execution
This module exploits a PHP object injection vulnerability in vBulletin 5.1.2 to 5.1.9 Module Options msf use exploit/multi/http/vbulletin/unserialize msf undefinedunserialize show actions ...actions... msf undefinedunserialize set ACTION msf undefinedunserialize show options ...show and set...
Design/Logic Flaw
system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie...
CVE-2015-5687
system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie...
CVE-2015-5687
AnchorCMS 0.9.x is vulnerable to PHP object injection and arbitrary code execution via a crafted serialized object in a cookie. The root cause is the cookie-based session driver failing to filter malicious serialized objects in the cookie, allowing an attacker to inject PHP objects and execute co...
CVE-2015-5687: Improper Control of Generation of Code
system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie...
PT-2015-7034
Name of the Vulnerable Software and Affected Versions Anchor CMS versions 0.9.x Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie. This is related to the system/session/drivers/cookie.ph...
ownCloud: owncloud.com: WP Super Cache plugin is outdated
I know it might be out of scope, but I report it to be sure https://owncloud.org/wp-content/plugins/wp-super-cache/readme.txt shows version 1.4.4 and this version is prone to XSS and PHP Object injection http://z9.io/2015/09/25/wp-super-cache-1-4-5/...
