WordPress Theme This Way - upload_settings_image.php Arbitrary File Upload

WordPress Theme This Way - uploadsettingsimage.php Arbitrary File Upload source: https://www.securityfocus.com/bid/63523/info The This Way Theme for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately...

cPanel WebHost Manager 3.1 dofeaturemanager feature Parameter XSS

Exploit for php platform in category web applications source: http://www.securityfocus.com/bid/21288/info WebHost Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary...

Debian DSA-2787-1 : roundcube - design error

It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, does not properly sanitize the session parameter in steps/utils/savepref.inc during saving preferences. The vulnerability can be exploited to overwrite configuration settings and subsequently allowing rand...

Cisco Unified Communications Manager Administrative Web Interface Directory Traversal Vulnerability

A vulnerability in the administrative web interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to obtain the contents of arbitrary files on an affected device. The vulnerability is due to a failure to properly sanitize user-supplied input passed to a...

Alienvault Open Source SIEM (OSSIM) - 'Timestamp' Directory Traversal

source: https://www.securityfocus.com/bid/62899/info Open Source SIEM OSSIM is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue can allow an attacker to gain access to arbitrary system files. Information harvested ma...

Cisco Unified Computing System Fabric Interconnect clear sshkey Command Injection Vulnerability

A vulnerability in the clear sshkey command of the Cisco Unified Computing System fabric interconnect could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user. The vulnerability is due to a failure to properly sanitize user input. An...

Cisco Unified Computing System Fabric Interconnect run-script Command Injection Vulnerability

A vulnerability in the run-script command of the Cisco Unified Computing System fabric interconnect could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user. The vulnerability is due to a failure to properly sanitize user input. An...

FreeSMS - '/pages/crc_handler.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/63004/info FreeSMS is prone to multiple cross-site scripting vulnerabilities and an SQL-injection vulnerability because it fails to properly sanitize user-supplied input. Attackers can exploit these issues to execute arbitrary code in the context of the...

FreeSMS - '/pages/crc_handler.php?scheduleid' SQL Injection

source: https://www.securityfocus.com/bid/63004/info FreeSMS is prone to multiple cross-site scripting vulnerabilities and an SQL-injection vulnerability because it fails to properly sanitize user-supplied input. Attackers can exploit these issues to execute arbitrary code in the context of the...

OTRS Mailbox HTML Injection Vulnerability (OSA-2007-01)

Open Ticket Request System OTRS is prone to a HTML injection vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Moodle 'external.php' 'badge' Parameter XSS

The version of Moodle installed on the remote host fails to properly sanitize user-supplied input to the 'badge' parameter of the 'external.php' script. The application also fails to properly sanitize serialized objects. An attacker can exploit these issues by crafting a URL containing a serializ...

WordPress Plugin mukioplayer4wp - cid SQL Injection

WordPress Plugin mukioplayer4wp - cid SQL Injection source: https://www.securityfocus.com/bid/62438/info mukioplayer4wp for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue coul...

WordPress Plugin mukioplayer4wp - 'cid' SQL Injection

source: https://www.securityfocus.com/bid/62438/info mukioplayer4wp for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application,...

Joomla com_sectionex v2.5.96 SQL Injection vulnerabilities

------------------------------------------------------------------------------------- Joomla comsectionex v2.5.96 SQL Injection vulnerabilities ------------------------------------------------------------------------------------- == Description == - Software link: http://stackideas.com/sectionex ...

Amazon Linux AMI : busybox (ALAS-2012-103)

A buffer underflow flaw was found in the way the uncompress utility of BusyBox expanded certain archive files compressed using Lempel-Ziv compression. If a user were tricked into expanding a specially crafted archive file with uncompress, it could cause BusyBox to crash or, potentially, execute...

fog-dragonfly Gem for Ruby imagemagickutils.rb Remote Command Execution

fog-dragonfly Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input passed via the imagemagickutils.rb script. This may allow a remote attacker to execute arbitrary commands...

Xibo - 'layout' HTML Injection

source: https://www.securityfocus.com/bid/62063/info Xibo is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal...

Xibo - layout HTML Injection

Xibo - layout HTML Injection source: https://www.securityfocus.com/bid/62063/info Xibo is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially...

CakePHP 2.2.8/2.3.7 - AssetDispatcher Class Local File Inclusion

source: https://www.securityfocus.com/bid/61746/info CakePHP is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this vulnerability to view files or execute arbitrary script code in the context of the web server...

DotNetNuke 6.1.x - Cross-Site Scripting

DotNetNuke 6.1.x - Cross-Site Scripting source: https://www.securityfocus.com/bid/61770/info DotNetNuke is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser o...