CVE-2013-6288

CVE-2013-6288: A vulnerability in the Apache Solr for TYPO3 (solr) extension prior to 2.8.3 for TYPO3 is due to insecure unserialize. The TYPO3 security bulletin confirms affected versions up to 2.8.2 and documents remediation by releasing version 2.8.3. Other sources reiterate the same issue and...

Moodle 2.5.0-1 (badges/external.php) PHP Object Injection Vulnerability

============================================= - Original release date: 15 September, 2013 - Discovered by: Emilio Pinna Application Security Analyst at Abinsula - Contact: emilio pinn gmail ============================================= VULNERABILITY ---------------------- Moodle CMS version 2.5.0...

Several vulnerabilities in extension Apache Solr for TYPO3 (solr)

It has been discovered that the extension "Apache Solr for TYPO3" solr is vulnerable to Cross-Site Scripting and Insecure Unserialize. Release Date: September 25, 2013 Bulletin Update: November 06, 2014 added CVEs Component Type: Third party extension. This extension is not a part of the TYPO3...

Several vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third-party TYPO3 extensions: booking, cronmmratsinfo, icsawstats, iflowgallery, keuserregister, metabeawstatsind, powermailoptin, smarty, youtubevideos Release Date: September 25, 2013 Please read first: This Collective Security Bulletin C...

Mandriva Linux Security Advisory : wordpress (MDVSA-2013:239)

Updated wordpress and php-phpmailer packages fix security vulnerabilities : wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations...

WordPress < 3.6.1 PHP object injection vulnerability-vulnerability warning-the black bar safety net

0x00 background When I read an article about the Joomla“PHP object injection”vulnerability in a blog post, I dug deep it found Stefan Esser God in 2 0 1 0 annual black hat conference articles: http://media.blackhat.com/bh-us- ... Exploits-slides. pdf This article has mentioned in PHP unserialize...

Moodle CMS 2.5.0-1 Cross Site Scripting Vulnerability

Moodle CMS version 2.5.0-1 suffers from a cross site scripting vulnerability. ============================================= - Original release date: 15 September, 2013 - Discovered by: Emilio Pinna Application Security Analyst at Abinsula - Contact: emilio pinn gmail...

Moodle CMS 2.5.0-1 Cross Site Scripting

============================================= - Original release date: 15 September, 2013 - Discovered by: Emilio Pinna Application Security Analyst at Abinsula - Contact: emilio pinn gmail ============================================= VULNERABILITY ---------------------- Moodle CMS version 2.5.0...

CVE-2013-4338

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations...

DEBIAN-CVE-2013-4338

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations...

CVE-2013-4338

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations...

Code injection

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations...

CVE-2013-4338

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations...

UBUNTU-CVE-2013-4338

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations...

CVE-2013-4338

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations...

CVE-2013-5303

Unspecified vulnerability in the Store Locator locator extension before 3.1.5 for TYPO3 has unknown impact and remote attack vectors, related to "Insecure Unserialize."...

Sql injection

Unspecified vulnerability in the Store Locator locator extension before 3.1.5 for TYPO3 has unknown impact and remote attack vectors, related to "Insecure Unserialize."...

CVE-2013-5303

CVE-2013-5303 corresponds to a vulnerability in the TYPO3 Store Locator extension (locator) prior to 3.1.5. The connected CSB documents indicate multiple issues for this extension during that period, including Insecure Unserialize and, in some listings, SQL Injection and Cross‑Site Scripting affe...

CVE-2013-5303

Unspecified vulnerability in the Store Locator locator extension before 3.1.5 for TYPO3 has unknown impact and remote attack vectors, related to "Insecure Unserialize."...

[RIPS] A static source code analyser for vulnerabilities in PHP scripts

RIPS is a tool written in PHP to find vulnerabilities in PHP applications using static code analysis. By tokenizing and parsing all source code files RIPS is able to transform PHP source code into a program model and to detect sensitive sinks potentially vulnerable functions that can be tainted b...