Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function...

CVE-2015-5665

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function...

CVE-2015-5665

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function...

CVE-2015-5665

LOCKON EC-CUBE is affected by a CSRF vulnerability (CWE-352) affecting versions 2.11.0 through 2.13.3 (some sources list up to 2.13.4). The flaw enables an attacker to hijack the authentication of arbitrary users by inducing requests that write to PHP scripts, tied to the doValidToken function. I...

CVE-2015-5691

Multiple cross-site scripting XSS vulnerabilities in PHP scripts in the management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, as demonstrated an attack against...

Sql injection

Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection SEP before 12.1.6 allow remote authenticated users to execute arbitrary SQL commands by leveraging the Limited Administrator role...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PHP scripts in the management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, as demonstrated an attack against...

CVE-2015-5691

Multiple cross-site scripting XSS vulnerabilities in PHP scripts in the management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, as demonstrated an attack against...

PT-2015-4168

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection versions prior to 12.1.6 Description The issue concerns SQL injection vulnerabilities in the Manager component's interface PHP scripts. These vulnerabilities allow remote authenticated users with the Limited...

PT-2015-7038

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions prior to 5.2.2 DB 5.0.0.1277 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in PHP scripts within the management console of Symantec Web Gateway appliances. These vulnerabilities...

Thomson Reuters FATCA - Arbitrary File Upload

Title: Thomson Reuters FATCA - Arbitrary File Upload Author: Jakub Paaczyski Date: 10. June 2015 CVE: CVE-2015-5951 Affected software: ================== All versions of Thomson Reuters FATCA below v5.2 Exploit was tested on: ====================== Thomson Reuters FATCA v5.1.0.30 Description:...

Thomson Reuters FATCA Arbitrary File Upload Vulnerability

Thomson Reuters FATCA suffers from an arbitrary file upload vulnerability that can result in command execution. Title: Thomson Reuters FATCA - Arbitrary File Upload Author: Jakub Pałaczyński Date: 10. June 2015 CVE: CVE-2015-5951 Affected software: ================== All versions of Thomson Reute...

CVE-2015-1493

Directory traversal vulnerability in the mingetslashargument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter, as demonstrated ...

Directory traversal

Directory traversal vulnerability in the mingetslashargument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter, as demonstrated ...

CVE-2015-1493

Directory traversal vulnerability in the mingetslashargument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter, as demonstrated ...

[SECURITY] Fedora 20 Update: yourls-1.7-3.20150410gitabc7d6c.fc20

YOURLS is a small set of PHP scripts that will allow you to run your own URL shortening service a la TinyURL. You can make it private or public, you can pick custom keyword URLs, it comes with its own API...

WordPress Holding Pattern Theme Arbitrary File Upload Exploit

This module exploits a file upload vulnerability in all versions of the Holding Pattern theme found in the uploadfile.php script which contains no session or file validation. It allows unauthenticated users to upload files of any type and subsequently execute PHP scripts in the context of the web...

Maarch LetterBox 2.8 Unrestricted File Upload Exploit

This Metasploit module exploits a file upload vulnerability on Maarch LetterBox 2.8 due to a lack of session and file validation in the filetoindex.php script. It allows unauthenticated users to upload files of any type and subsequently execute PHP scripts in the context of the web server. This...

Maarch LetterBox 2.8 Unrestricted File Upload

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'uri' class Metasploit3 'Maarch LetterBox 2.8 Unrestricted File Upload', 'Description' = %q This module exploits a file upload vulnerabilit...

Design/Logic Flaw

The management console on the Symantec Web Gateway SWG appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts...