WordPress CMS: source code security analysis report

Several vulnerabilities were discovered in Wordpress Foundation 'WordPress CMS' software: File System Path Manipulation Using Global Variables Incorrect User Input Filtration when Using the unserialize Function Using Insufficiently Random Generators in Cryptography HttpOnly Cookies Incorrect User...

Drupal CMS: source code security analysis report

Several vulnerabilities were discovered in Drupal Association 'Drupal CMS' software: Incorrect User Input Filtration when Generating Code on the Fly Using Global Variables Incorrect User Input Filtration when Using the unserialize Function Hardcoded Credentials Using Insufficiently Random...

Cacti <= 0.8.8f Multiple Vulnerabilities - Linux

Cacti is prone to multiple vulnerabilities. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

NationBuilder Multiple Stored XSS Vulnerabilities

Summary NationBuilder is a unique nonpartisan community organizing system that brings together a comprehensive suite of tools that today's leaders and creators need to gather their tribes. Deeply social. Description The application suffers from multiple stored XSS vulnerabilities. Input passed to...

MODX Revolution: source code security analysis report

Several vulnerabilities were discovered in MODX 'MODX Revolution' software: Incorrect User Input Filtration when Connecting to External Files File System Path Manipulation Using Global Variables Incorrect User Input Filtration when Using the unserialize Function Using Insufficiently Random...

NUnit: source code security analysis report

Several vulnerabilities were discovered in NUnit.org 'NUnit' software: Использование статических генераторов псевдослучайных чисел в криптографических целях Некорректная фильтрация пользовательского ввода при передаче управления сторонним компонентам Некорректная фильтрация пользовательского ввод...

AddToMenu Joomla Extensions Free: source code security analysis report

Several vulnerabilities were discovered in Regular Labs 'AddToMenu Joomla Extensions Free' software: Incorrect Permissions for External Entities During XML Document Processing Incorrect User Input Filtration when Generating Code on the Fly...

ManageEngine Firewall Analyzer < 12.0 Multiple Vulnerabilities

The version of ManageEngine Firewall Analyzer running on the remote web server is prior to 12.0. It is, therefore, affected by multiple vulnerabilities : - A SQL injection vulnerability exists in the runQuery.do script due to improper sanitization of user-supplied input to the 'RunQuerycommand'...

Microsoft Windows OLE Remote Code Execution Vulnerability (3146706)

This host is missing an important security update according to Microsoft Bulletin MS16-044. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Windows OLE Remote Code Execution Vulnerability

A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input. An attacker could exploit the vulnerability to execute malicious code. To exploit the vulnerability, an attacker would have to convince a user to open either a specially crafted file or ...

Cross-Site Scripting in TYPO3 Backend

It has been discovered, that TYPO3 is susceptible to Cross-Site Scripting. Component Type: TYPO3 CMS Release Date: April 12, 2016 Vulnerable subcomponent: Backend Vulnerability Type: Cross-Site Scripting Affected Versions: Versions 6.2.0 to 6.2.19, 7.6.0 to 7.6.4 and 8.0.0 Severity: Medium...

Arbitrary File Disclosure in Form Component

It has been discovered, that TYPO3 Form Component is susceptible to Arbitrary File Disclosure. Component Type: TYPO3 CMS Release Date: April 12, 2016 Vulnerable subcomponent: Form Vulnerability Type: Arbitrary File Disclosure Affected Versions: Versions 6.2.0 to 6.2.19 Severity: High Suggested CV...

Possible Information Leak Vulnerability

Applications that pass unverified user input to the render method in a controller may be vulnerable to an information leak vulnerability. Impacted code will look something like this: def index; render params:id; end Carefully crafted requests can cause the above code to render files from unexpect...

Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability

A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability is due to insufficient sanitization of HTTP user-supplied input...

Joomla!: source code security analysis report

Several vulnerabilities were discovered in Open Source Matters, Inc. 'Joomla!' software: Using Global Variables Incorrect User Input Filtration when Using the unserialize Function Using Insufficiently Random Generators in Cryptography Incorrect Permissions for External Entities During XML...

Template Injection

Overview Affected versions of jsrender are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input. Proof of Concept for x!=1?constructor.constructor"return arguments.callee.caller":y10 :data /for function...

Bumble: Insecure Direct Object Reference on badoo.com

Hi, I want to report IDOR Insecure Direct Object Reference vulnerability to you. IDOR Details are here: https://www.owasp.org/index.php/Top102010-A4-InsecureDirectObjectReferences https://www.owasp.org/index.php/TestingforInsecureDirectObjectReferences%28OTG-AUTHZ-004%29 As the pages say: Insecur...

Adobe AIR < 21.0.0.176 Multiple Vulnerabilities (APSB16-08)

Binary data 9177.prm...

Kaltura Remote PHP Code Execution

This module exploits an Object Injection vulnerability in Kaltura. By exploiting this vulnerability, unauthenticated users can execute arbitrary code under the context of the web server user. Kaltura has a module named keditorservices that takes user input and then uses it as an unserialized...

Microsoft Windows OLE Remote Code Execution Vulnerabilities (3143136)

This host is missing an important security update according to Microsoft Bulletin MS16-030. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...