PT-2016-4382

Name of the Vulnerable Software and Affected Versions Apache Jetspeed versions prior to 2.3.1 Description The issue concerns SQL injection vulnerabilities in the User Manager service. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. The vulnerabilities can be...

Gentoo Security Advisory GLSA 201401-26

Gentoo Linux Local Security Checks GLSA 201401-26 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

SQL Injection Vulnerability in OA Network Collaboration Office Platform User Parameters

Zhixiang OA office system is an enterprise office system. A SQL injection vulnerability exists in the user parameter of the mainpage/msglog.aspx page of Zhixiang OA network collaborative office platform. Comprehensive exploitation of the vulnerability allows attackers to utilize commonly used SQL...

CVE-2015-2035

SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php...

PT-2015-5559

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.7.4 Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved by exploiting the user parameter in the history page to "admin.php". Recommendations For versions prior to...

CVE-2015-2035: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php...

CVE-2015-1471: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in userprofile.lib.php in Pragyan CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to the default URI...

PT-2015-5308

Name of the Vulnerable Software and Affected Versions Pragyan CMS version 3.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting a SQL injection vulnerability in the userprofile.lib.php file, specifically via the user parameter to the...

WordPress Plugin Pixabay Images Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.Pixabay Images is one of the support for selecting photos from Pixabay image material sharing network in the CC0...

CVE-2014-9451: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in the DIVA web service API /webservice in VDG Security SENSE formerly DIVA 2.3.13 allow remote attackers to execute arbitrary code via the 1 user or 2 password parameter in an AuthenticateUser request...

PT-2014-8937

Name of the Vulnerable Software and Affected Versions Bird Feeder plugin version 1.2.3 Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the user or password parameter in th...

CVE-2014-9334: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 user or 2 password parameter in the bird-feeder page to...

PT-2017-8481

Name of the Vulnerable Software and Affected Versions Zabbix versions prior to 2.0.18 Zabbix versions 2.2.x prior to 2.2.13 Zabbix versions 3.0.x prior to 3.0.3 Description The issue allows context-dependent attackers to execute arbitrary code or SQL commands via the mysql.size parameter in the...

ScareCrow 2.13 profile.cgi user Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/15915/info ScareCrow is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have...

PHPPost 1.0 mail.php user Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/15524/info PHP-Post is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code ...

WebAdmin <= 2.0.4 USER Buffer Overflow Exploit

No description provided by source. This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artisti...

CVE-2014-1603

Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 param parameter to admin/load.php or 2 user, 3 email, or 4 name parameter in a Save Settings action to admin/settings.php...

CVE-2014-2736

Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the 1 session ID PHPSESSID to index.php or remote authenticated users to execute arbitrary SQL commands via the 2 user parameter to connectors/security/message.php ...

CVE-2013-6824

Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter...

DEBIAN-CVE-2013-6824

Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter...