CVE-2014-8375

SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commands via the selectedgroup parameter in a gbajaxgetgroup action to wp-admin/admin-ajax.php...

PT-2014-8498

Name of the Vulnerable Software and Affected Versions GB Gallery Slideshow plugin version 1.5 Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved by exploiting the selected group parameter in a gb ajax get group action to the...

PT-2014-2789

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 1.5.12 Mahara versions 1.6.x prior to 1.6.7 Mahara versions 1.7.x prior to 1.7.3 Description The issue allows remote authenticated users to read arbitrary artefacts. This can be achieved via the artefact id in an uploa...

Oracle Java FileDialog.Show Heap Buffer Overflow - Ver2 (CVE-2011-0802)

A remote code execution vulnerability has been reported in Oracle Java Runtime Environment.The vulnerability is due to insufficient validation of the selected file's default values size. A remote attacker could exploit this vulnerability by enticing an unsuspecting user to open a web page...

Spacewalk: PAGE_SIZE_LABEL_SELECTED cross-site scripting (XSS)

Multiple cross-site scripting XSS vulnerabilities in Spacewalk and Red Hat Network RHN Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the 1 whereCriteria variable in a software channels search; 2 endyear, 3 starthour, 4 endampm, 5 endday, 6 endhour, 7 endminute, 8...

PT-2012-5414

Name of the Vulnerable Software and Affected Versions Midnight Commander version 4.8.5 Description The issue arises from improper handling of the MC EXT SELECTED or MC EXT ONLYTAGGED environment variables when multiple files are selected. This allows remote attackers to execute arbitrary commands...

CVE-2011-4509: Undefined Security Weakness

The HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 aka TIA portal; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime has an improperly selected default password for the administrator account...

CVE-2011-5072

Multiple SQL injection vulnerabilities in Support Incident Tracker aka SiT! before 3.65 allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to portal/kb.php; 2 contractid parameter to contractaddservice.php; 3 id parameter to editescalationpath.php; 4 unlock, 5 lock...

PT-2012-2049

Name of the Vulnerable Software and Affected Versions Support Incident Tracker aka SiT! versions prior to 3.64 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including the exc parameter to "report marketing.php", the...

uzbl uzbl-core - @SELECTED_URI Mouse Button Bindings Command Injection

uzbl uzbl-core - @SELECTEDURI Mouse Button Bindings Command Injection source: https://www.securityfocus.com/bid/42297/info uzbl 'uzbl-core' is prone to a vulnerability that lets attackers inject arbitrary commands because the application fails to adequately sanitize user-supplied input. This issu...

CVE-2010-1126

CVE-2010-1126 targets WebKit’s JavaScript implementation. The vulnerability allows remote attackers to cause keystrokes intended for a visible frame to be sent to a form field in a hidden frame by certain focus() calls in WebKit. Affected component is the WebKit browser engine; impact is partial ...

Directory traversal

Directory traversal vulnerability in includes/block.php in Agares Media phpAutoVideo 2.21 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the selectedprovider parameter...

patbb-rfi.txt

Link to download: http://www.php-tools.net/site.php?file=patBBCode/overview.xml Vuln file: examples\patExampleGen\bbcodeSource.php Vuln code: if !isset $GET'example' die 'No example selected.' ; $exampleId = $GET'example'; obstart; // make the example think it's still in the right place chdir '.....

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Uebimiau Webmail allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to redirect.php or 2 the selectedtheme parameter to demo/pop3/error.php...

CVE-2006-6534

Multiple cross-site scripting XSS vulnerabilities in osCommerce 3.0a3 allow remote attackers to inject arbitrary web script or HTML via the 1 set parameter to admin/modules.php, the 2 selectedbox parameter to definitiva/admin/customers.php, the 3 lID parameter to admin/languagesdefinitions.php, o...

CVE-2005-3557: Undefined Security Weakness

Directory traversal vulnerability in admin/defaults.php in PHPlist 2.10.1 and earlier allows remote attackers to access arbitrary files via a .. dot dot in the selected%5B%5D parameter in an HTTP POST request...

Пользователь может обойти Inherited Rights Filters (IRF) в Novell Netware

Права на избранные свойства Selected Property Rights в Novell Netware могут наследоваться, но не могут быть блокированы с помощью IRF. Таким образом пользователь, имеющий права на родительский объект может овладеть дочерним объектом NDS, установив права на родительский объект и объявив их...