576 matches found
Remote file inclusion
Remote file download vulnerability in recent-backups v0.7 wordpress plugin...
CVE-2015-1000006
CVE-2015-1000006 corresponds to a remote file download vulnerability in the WordPress plugin recent-backups v0.7. Connected sources confirm a file‑download flaw in the plugin, with OpenVAS and WPVulnDB noting directory traversal/file download risk and WPEX exploit notes that download-file.php doe...
LHF (Low Hanging Fruit) - A Modular Recon Tool For Pentesting
To install dependencies: ./Install.sh To start: ./LHF.py + Checking permissions - Rockyou wordlist is missing trying to decompress... + Rockyou wordlist is decompressed! - Please enter the ip to scan example 192.168.0.1 or www.target.com : A "results" folder will be created after inputting the...
Direct3D Recent Program
Nessus was able to query the registry to find the most recent program to use Direct3D for each user on the remote Windows host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid92417; scriptversion"1.6"; scriptcvsdate"Date: 2018/11/15 20:50:27";...
CVE-2016-4971
creationtimestamp| type| source ---|---|--- 2016-07-06 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/40064 2021-04-30 16:26:41+00:00| published-proof-of-concept| https://t.me/pwnwikizhchannel/283 2024-11-14 06:08:59+00:00| seen| MISP/e8de7faf-a595-4c5b-bcd7-ecddfbfa56af...
The vulnerability of the Foxit Reader software, which allows a malicious actor to compromise protected information
Cross-site execution of stored scripts in Foxit Reader when reading and displaying file names and their paths in the “Recent Documents” section on the initial page allows attackers to replace registry entries and force the application to download malicious files...
greenwall.org XSS vulnerability
Vulnerable URL: http://greenwall.org/recent-news.php?id=16%22/%3E%3Cimg%20src=x%20onerror=alert%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 23:06 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alex...
Server: Reflected XSS in OCS provider discovery
A Cross-site scripting XSS vulnerability in the OCS discovery provider in ownCloud Servers allows remote attackers to inject arbitrary web script or HTML via the URL resulting in a reflected Cross-Site-Scripting. Since ownCloud employs a strict Content-Security-Policy that forbids inline script...
Recent Posts Widget Extended <= 0.9.9.3 - Authenticated XSS (multisite)
XSS in the Recent Posts Widget Extended plugin allows single site admins to change network admin's password with simple CSRF described above POC field. This vulnerability is currently unpatched. PoC 1. Login as single site administrator 2. Add Recent Posts Extended Widget to some widget area 3...
WordPress Recent Posts Widget Extended Plugin <= 0.9.9.3 - Authenticated XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Upgrade the plugin...
Android Security Restriction Bypass Vulnerability (CNVD-2015-06603)
Android is an operating system based on the Linux open kernel, announced on November 5, 2007 by Google Inc. for cell phones. A security restriction bypass vulnerability exists in Android versions prior to 5.1.1, LMY48I. This allows an attacker to bypass the target getRecentTasks restriction and...
Design/Logic Flaw
The Apple Pay component in Apple iOS before 9 allows remote terminals to obtain sensitive recent-transaction information during payments by leveraging the transaction-log feature...
WordPress Recent Backups Plugin 0.7 - Arbitrary File Download
Recent Backups plugin is prone to an arbitrary file download vulnerability because "download-file.php" does not verify the user is logged. It allows an attacker to download arbitrary files from the web server and get potentially sensitive information. Solution Update the plugin...
WordPress Recent Backups 0.7 File Download
Title: Remote file download vulnerability in recent-backups v0.7 wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-07-13 Download Site: https://wordpress.org/plugins/recent-backups Vendor: https://profiles.wordpress.org/andycheeseman/ Vendor Notified: 0000-00-00 Vendor Contact:...
recent-backups <= 0.7 - Remote File Download
Plugin is still affected and has been closed. The code in download-file.php does not verify if the user is logged in or sanitize which files can be downloaded. This vulnerability can be used to download sensitive system files, such as the Linux passwd file. $ curl -v...
WordPress Sliding Recent Posts 1.0 CSRF / XSS
Title: WordPress 'Sliding Recent Posts' plugin - CSRF/XSS Version: 1.0 Author: Morten Nørtoft, Kenneth Jepsen, Mikkel Vej Date: 2014/12/12 Download: https://wordpress.org/plugins/sliding-recent-posts/ Notified WordPress: 2014/11/27 ----------------------------------------------------------------...
[ MDVSA-2014:126 ] phpmyadmin
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:126 http://www.mandriva.com/en/support/security/ Package : phpmyadmin Date : July 8, 2014 Affected: Business Server 1.0 Problem Description: Multiple vulnerabilities has been discovered and corrected in...
UMPlayer Portable 0.95 Crash PoC
No description provided by source. Exploit Title: UMPlayer Portable Edition Date: 2012-11-28 Exploit Author: p3kok Vendor Homepage: http://www.umplayer.com/ Software Link: http://sourceforge.net/projects/umplayer/ or http://www.umplayer.com/download/ Version: 0.95Portable Edition Compiled 4.7.0...
DEBIAN-CVE-2014-4348
Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted 1 database name or 2 table name that is improperly handled after presence in a the favorite list or b recent tables...
CVE-2014-4348
Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted 1 database name or 2 table name that is improperly handled after presence in a the favorite list or b recent tables...