PT-2015-6970 · Blackcat · Blackcat Cms

Name of the Vulnerable Software and Affected Versions: BlackCat CMS version 1.1.2 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the name in a new group to "backend/groups/index.php" API endpoint. This enables attackers to perform cross-site scripting XS...

phpMoAdmin Arbitrary Command Execution Vulnerability

phpMoAdmin is a MongoDB GUI management tool . An arbitrary command execution vulnerability exists in phpMoAdmin 1.1.2, which allows remote attackers to execute arbitrary commands via shell metacharacters in object parameters...

[RT-SA-2014-015] Cross-site Scripting in Tapatalk Plugin for WoltLab Burning Board 4.0

Advisory: Cross-site Scripting in Tapatalk Plugin for WoltLab Burning Board 4.0 RedTeam Pentesting discovered a cross-site scripting XSS vulnerability in the Tapatalk plugin for the WoltLab Burning Board forum software, which allows attackers to inject arbitrary JavaScript code via URL parameters...

DSA-3088-1 qemu-kvm - security update

Bulletin has no description...

Debian Security Advisory DSA 3087-1 (qemu - security update)

Paolo Bonzini of Red Hat discovered that the blit region checks were insufficient in the Cirrus VGA emulator in qemu, a fast processor emulator. A privileged guest user could use this flaw to write into qemu address space on the host, potentially escalating their privileges to those of the qemu...

PT-2014-7717 · Ntelos · Ntelos

Name of the Vulnerable Software and Affected Versions: My nTelos application version 1.1.2 Description: The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Debian DSA-3044-1 : qemu-kvm - security update

Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware : - Various security issues have been found in the block qemu drivers. Malformed disk images might result in the execution of arbitrary code. - A NULL pointer dereference in SLIRP may result in...

ChillyCMS Blind SQL Injection

No description provided by source. !/usr/bin/hybris Exploit Title: ChillyCMS Blind Sql Injection Date: 14-05-2010 Author: IHTeam Software Link: http://chillycms.bplaced.net/chillyCMS/core/show.site.php?id=9 Version: 1.1.2 Tested on: Win/Linux Example: simone@simons Advisories$ hybris chillycms.hy...

7Media Web Solutions EduTrac < 1.1.2 Directory Traversal Vulnerability

7Media Web Solutions EduTrac is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

eduTrac目录遍历漏洞

Bugtraq ID:64255 eduTrac是一个开源的学生管理信息系统。 eduTrac存在一个未明目录遍历漏洞，允许远程攻击者利用漏洞提交特殊请求，查看系统文件内容。 0 eduTrac 1.1.1-Stable eduTrac 1.1.2版本以修复此漏洞，建议用户下载使用： http://sourceforge.net/projects/edutrac/...

Security fix for the ALT Linux 8 package libvirt version 1.1.2-alt1

Sept. 3, 2013 Alexey Shabalin 1.1.2-alt1 - 1.1.2 - fixed CVE-2013-4291, CVE-2013-4292, CVE-2013-5651...

JVN#80922020: ArtIME Japanese Input vulnerable to information disclosure

ArtIME Japanese Input is a Japanese Input Method Editor IME for Android devices. ArtIME Japanese Input contains an issue in the access permissions for the certain files. Impact If a user of the affected product uses other malicious Android application, information managed by the affected product...

Facebook Camera App Vulnerable to Man in The Middle Attack

Egypt-based security researcher reported that Facebook Camera App for mobiles are Vulnerable to Man in The Middle Attack, that allow an attacker to tap the network and hijack Camera users accounts and information like email addresses and passwords can be stolen. Mohamed Ramadan trainer with...

Facebook Camera App Vulnerable to Man in The Middle Attack

Egypt-based security researcher reported that Facebook Camera App for mobiles are Vulnerable to Man in The Middle Attack, that allow an attacker to tap the network and hijack Camera users accounts and information like email addresses and passwords can be stolen. Mohamed Ramadan trainer with...

Cross site scripting

Cross-site scripting XSS vulnerability in the Modern FAQ irfaq extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the "return url parameter."...

PT-2011-5169 · Pligg · Pligg Cms

Name of the Vulnerable Software and Affected Versions: Pligg CMS version 1.1.2 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the status parameter in the "search.php" file. Recommendations: For Pligg CMS version 1.1.2, consider restricting...

WordPress Plugin File Groups 1.1.2 - SQL Injection

WordPress Plugin File Groups 1.1.2 - SQL Injection Exploit Title: WordPress File Groups plugin getcol"select guid from wpposts where postparent = $fgid";...

WordPress Plugin File Groups 1.1.2 - SQL Injection

Exploit Title: WordPress File Groups plugin getcol"select guid from wpposts where postparent = $fgid";...

DocMGR 1.1.2 - 'history.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/47861/info DocMGR is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of...

pam: pam_xauth missing return value checks from setuid() and similar calls

The runcoprocess function in pamxauth.c in the pamxauth module in Linux-PAM aka pam before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pamxauth PAM check...