Wordpress filedownload plugin SQL injection vulnerability

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language. filedownload is one of the file download plugin. A SQL injection vulnerability exists in version v1.4 of the Wordpress filedownload plugin, which can be exploited by an attacker to execute...

Moxa DACenter Vulnerabilities

OVERVIEW Independent researcher Zhou Yu has identified denial-of-service and unquoted service path privilege escalation vulnerabilities in Moxa’s DACenter application. Moxa has produced a patch to mitigate these vulnerabilities. Zhou Yu has tested the patch to validate that it resolves the...

WordPress plugin Vospari Forms <= 1.3 - Reflected Cross-Site Scripting (XSS) vulnerability

WordPress plugin Vospari Forms version 1.3 vulnerable to Reflected Cross-Site Scripting XSS. Altering the URL would allow for the XSS to be executed for further exploitation. Solution Update plugin to the latest version at least version 1.4...

SquidGuard Cross-Site Scripting Vulnerability

Shalla Secure Services squidGuard is a URL redirection plug-in for Squid proxy server and web caching server software from Shalla Secure Services, Germany. A cross-site scripting vulnerability exists in versions 1.3 and 1.4 of squidGuard. An attacker can exploit this vulnerability to inject...

Adobe DNG Software Development Kit Memory Corruption Vulnerability

Adobe DNG Software Development Kit SDK is the United States of America Ordoby Adobe company's set of software development tools for reading and writing DNG files as well as converting DNG data format. A security vulnerability exists in Adobe DNG SDK 1.4 2012 release and earlier versions for Windo...

Cisco Unified Computing System Central Cross-Site Scripting Vulnerability

Cisco Unified Computing System UCS Central is a suite of software from Cisco that manages the Cisco UCS server domain. The software provides policy-based automation of servers to improve IT efficiency and centralized fault overview of rapid problem solving and other features. A cross-site scripti...

PT-2015-1974

Name of the Vulnerable Software and Affected Versions Django versions 1.4.x through 1.4.21 Django versions 1.7.x through 1.7.9 Django versions 1.8.x through 1.8.3 Description The issue is related to a resource management error in the contrib.sessions.middleware.SessionMiddleware component of the...

Artnana Webboard 1.4 Cross Site Scripting

Artnana Webboard version 1.4 XSS Cross-site Scripting Web Security Vulnerabilities Exploit Title: Artnana Webboard version 1.4 Multiple XSS Security Vulnerabilities Product: Webboard Vendor: Artnana Vulnerable Versions: version 1.4 Tested Version: version 1.4 Advisory Publication: May 09, 2015...

Soitec SmartEnergy 1.4 - SCADA Login SQL Injection / Authentication Bypass

Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass Exploit Vendor: Soitec Product web page: http://www.soitec.com Affected version: 1.4 and 1.3 Summary: Soitec power plants are a profitable and ecological investment at the same time. Using Concentrix technology, Soitec offers...

Foreman: Stored Cross Site Scripting

Cross-site scripting XSS vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark...

Asterisk 'asterisk-addons' 1.2.7/1.4.3 CDR_ADDON_MYSQL Module SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/26095/info Asterisk 'asterisk-addons' package is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an...

LogIT 1.3/1.4 - Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/16932/info LogIT is prone to a remote file-include vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input. Attackers may specify remotely hosted script files to be executed ...

jobappr <= 1.4 - Multiple Vulnerabilities

No description provided by source. ======================================= JobAppr = 1.4 Multiple Vulnerabilities ======================================= Author: giudinvx Email: giudinvxatgmaildotcom Date: 21/12/2010 Site: http://www.giudinvx.altervista.org/...

Everfocus <= 1.4 EDSR Remote Authentication Bypass

No description provided by source. Product: Everfocus EDSR series Version affected: 1.4 and older Website: http://www.everfocus.com/ Discovered By: Andrea Fabrizi Email: andrea.fabrizi gmail com Web: http://www.andreafabrizi.it Vuln: remote DVR applet authentication bypass The EDSR firmware don't...

Rack: Multiple vulnerabilities

Background Rack is a modular Ruby web server interface. Description Multiple vulnerabilities have been discovered in Rack. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a...

CVE-2013-4331

Light Display Manager aka LightDM 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7.14 uses 0664 permissions for the temporary .Xauthority file, which allows local users to obtain sensitive information by reading the file...

PYSEC-2013-21

The issafeurl function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting XSS or other vulnerabilities into Django applications that use this function, a...

PT-2013-1365 · Apache · Apache Santuario Xml Security For Java

Name of the Vulnerable Software and Affected Versions: Apache Santuario XML Security for Java versions 1.4.x through 1.4.7 Apache Santuario XML Security for Java versions 1.5.x through 1.5.4 Description: The issue allows context-dependent attackers to spoof an XML Signature by using the...

nginx ngx_http_proxy_module.c Multiple Vulnerabilities

The installed version of nginx is 1.1.4 through 1.2.8, 1.3.x, or 1.4.x prior to 1.4.1. It is, therefore, affected by multiple vulnerabilities: - A stack-based buffer overflow in 'ngxhttpparse.c' may allow a remote attacker to execute arbitrary code or trigger a denial of service condition via a...

PT-2013-2198

Name of the Vulnerable Software and Affected Versions Rack versions 1.1.x before 1.1.6 Rack versions 1.2.x before 1.2.8 Rack versions 1.3.x before 1.3.10 Rack versions 1.4.x before 1.4.5 Rack versions 1.5.x before 1.5.2 Description The issue allows remote attackers to guess the session cookie, ga...