Cerb 7.0.3 Cross Site Request Forgery Vulnerability

Cerb version 7.0.3 suffers from a cross site request forgery vulnerability. Product: Cerb Vendor: Webgroup Media LLC Vulnerable Versions: 7.0.3 and probably prior Tested Version: 7.0.3 Advisory Publication: August 12, 2015 without technical details Vendor Notification: August 12, 2015 Vendor Patc...

WordPress Car Rental System SQL Injection Vulnerability

WordPress Car Rental System plugin versions prior to 3.1 suffer from a remote SQL injection vulnerability. Exploit Title : Car Rental System Native WordPress Plugin SQL Injection vulnerability version3.1 Author : Manish Kishan Tanwar AKA error1046 Vendor Link :...

Thycotic Secret Server 8.8.000004 Cross Site Scripting

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html CVE ID : CVE-2015-3443 Product: Secret Server 1 Vendor: Thycotic Subject: Stored Cross-Site Scripting Vulnerability XSS Risk: High Effect: Remotely exploitable Author: Marco Delai [email protected] Date: June 24th 2015...

Bonita BPM 6.5.1 Directory Traversal / Open Redirect

Advisory ID: HTB23259 Product: Bonita BPM Vendor: Bonitasoft Vulnerable Versions: 6.5.1 and probably prior Tested Version: 6.5.1 Windows and Mac OS packages Advisory Publication: May 7, 2015 without technical details Vendor Notification: May 7, 2015 Vendor Patch: June 9, 2015 Public Disclosure:...

Bonita BPM 6.5.1 - Multiple Vulnerabilities

Bonita BPM 6.5.1 - Multiple Vulnerabilities Advisory ID: HTB23259 Product: Bonita BPM Vendor: Bonitasoft Vulnerable Versions: 6.5.1 and probably prior Tested Version: 6.5.1 Windows and Mac OS packages Advisory Publication: May 7, 2015 without technical details Vendor Notification: May 7, 2015...

Bonita BPM 6.5.1 Directory Traversal / Open Redirect Vulnerabilities

Exploit for php platform in category web applications Product: Bonita BPM Vendor: Bonitasoft Vulnerable Versions: 6.5.1 and probably prior Tested Version: 6.5.1 Windows and Mac OS packages Advisory Publication: May 7, 2015 without technical details Vendor Notification: May 7, 2015 Vendor Patch:...

Bonita BPM 6.5.1 - Multiple Vulnerabilities

Advisory ID: HTB23259 Product: Bonita BPM Vendor: Bonitasoft Vulnerable Versions: 6.5.1 and probably prior Tested Version: 6.5.1 Windows and Mac OS packages Advisory Publication: May 7, 2015 without technical details Vendor Notification: May 7, 2015 Vendor Patch: June 9, 2015 Public Disclosure:...

Fedora 21 : mksh-50f-1.fc21 (2015-6550)

"R50f is a required security and bugfix release : - Add a patch marker for vendor patch versioning to mksh.1 - SECURITY: make unset HISTFILE actually work - Document some more issues with the current history code - Remove some unused code - RCSID-only sync with OpenBSD, for bogus and irrelevant...

Fedora 22 : mksh-50f-1.fc22 (2015-6558)

"R50f is a required security and bugfix release : - Add a patch marker for vendor patch versioning to mksh.1 - SECURITY: make unset HISTFILE actually work - Document some more issues with the current history code - Remove some unused code - RCSID-only sync with OpenBSD, for bogus and irrelevant...

Rsync path spoofing attack vulnerability-vulnerability warning-the black bar safety net

Affected system: Samba rsync 3.1.1 Description: CVECAN ID: CVE-2 0 1 4-9 5 1 2 rsync is a fast incremental file transfer tool that is used in the same host the backup inside the backup. rsync 3.1.1 version there is a path spoofing attack vulnerability, through the synchronization path of the file...

Wordpress Video Gallery 2.7.0 SQL Injection Vulnerability

Photo Gallery Plugin for WordPress contains a flaw that allows a remote attacker to execute arbitrary PHP code. This flaw exists because the photo-gallery\photo-gallery.php script allows access to filemanager\UploadHandler.php. The post method in UploadHandler.php Exploit Title : Wordpress Video...

ferretCMS 1.0.4-alpha Cross Site Scripting / SQL Injection

Advisory: Advisory ID: SROEADV-2015-10 Author: Steffen Rösemann Affected Software: ferretCMS v. 1.0.4-alpha Vendor URL: https://github.com/JRogaishio/ferretCMS Vendor Status: vendor will patch eventually CVE-ID: - Tested on: - Firefox 35, Iceweasel 31 - Mac OS X 10.10, Kali Linux 1.0.9a...

Sefrengo CMS 1.6.0 Cross Site Scripting

Advisory: Reflecting XSS vulnerability in CMS Sefrengo v.1.6.0 Advisory ID: SROEADV-2014-06 Author: Steffen Rösemann Affected Software: CMS Sefrengo v.1.6.0 Vendor URL: http://www.sefrengo.org/ Vendor Status: solved CVE-ID: - ========================== Vulnerability Description:...

CVE-2014-2025 Remote Code Execution (RCE) in "Intrexx Professional"

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-2025 =================== "Remote Code Execution RCE via Unrestricted File Upload" CWE-434 vulnerability in "Intrexx Professional" product Vendor =================== United Planet GmbH Product =================== "Intrexx is an integrated...

OracleVM 3.3 : nss (OVMSA-2014-0082)

The remote OracleVM system is missing necessary patches to address critical security updates : nss - Added nss-vendor.patch to change vendor - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3 - Remove unused indentation pseudo patch - require nss util 3.16.2.3 - Restore patch for...

Thomson Reuters Fixed Assets CS <=13.1.4 - Privileges Escalation Exploit

Exploit for windows platform in category local exploits Exploit Title: Thomson Reuters Fixed Assets CS Windows 7, Windows 8 CVE : 2014-9141 Product Affected: Fixed Assets CS =13.1.4 Workstation Install Note: 2003/2008 Terminal Services/Published apps may be vulnerable, depending on system...

Thomson Reuters Fixed Assets CS 13.1.4 - Local Privilege Escalation

Thomson Reuters Fixed Assets CS 13.1.4 - Local Privilege Escalation Exploit Title: Thomson Reuters Fixed Assets CS Windows 7, Windows 8 CVE : 2014-9141 Product Affected: Fixed Assets CS =13.1.4 Workstation Install Note: 2003/2008 Terminal Services/Published apps may be vulnerable, depending on...

Thomson Reuters Fixed Assets CS 13.1.4 - Local Privilege Escalation

Exploit Title: Thomson Reuters Fixed Assets CS Windows 7, Windows 8 CVE : 2014-9141 Product Affected: Fixed Assets CS =13.1.4 Workstation Install Note: 2003/2008 Terminal Services/Published apps may be vulnerable, depending on system configuration. This vulnerability has been reference checked...

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting

Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without technical details Vendor Notification: 16 July, 2014 Vendor Patch: 15 July, 2014 Public Disclosure: 2 November , 2014 Vulnerability Type:...

webEdition 6.3.8.0 (SVN-Revision: 6985) - Path Traversal

No description provided by source. Advisory ID: HTB23227 Product: webEdition Vendor: webEdition e.V. Vulnerable Versions: 6.3.8.0 SVN-Revision: 6985 and probably prior Tested Version: 6.3.8.0 SVN-Revision: 6985 Advisory Publication: August 6, 2014 without technical details Vendor Notification:...