CMSLogik version 1.2.1 suffers from a user enumeration weakness vulnerability.
6f004115f2ebeefbc18d7e2b8a7dc2aeCMSLogik version 1.2.1 remote shell upload exploit that leverages upload_file_ajax().
baaeffbd26f6f66a85728c22ff736084CMSLogik version 1.2.1 suffers from multiple persistent cross site scripting vulnerabilities.
4e64dbad8be4474869774a7334f9fe2aSetSeed CMS version 5.8.20 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the vulnerable script using the cookie input 'loggedInUser', which could allow the attacker to view, add, modify or delete information in the back-end database.
8c96c57ab1674a5a7830221715da9383vtiger CRM version 5.2.1 suffers from a cross site scripting vulnerability when parsing user input to the _operation and search parameters in the /modules/mobile/index.php script.
a7d89bbf10088e68e0ccfdaa4b470cb0Cotonti CMS version 0.9.4 suffers from cross site scripting and remote SQL injection vulnerabilities.
1545975a349602f84b255405ea7dd834Ashampoo Burning Studio Elements version 10.0.9 suffers from a heap overflow vulnerability. It fails to properly sanitize user supplied input when parsing .ashprj project file formats resulting in a crash corrupting the heap-based memory. The attacker can use this scenario to lure unsuspecting users to open malicious crafted .ashprj files with a potential for arbitrary code execution on the affected system.
f0492e7bbdbe04926e536db6204979b5Adobe Photoshop Elements 8 suffers from a buffer overflow vulnerability when dealing with .ABR (brushes) and .GRD (gradients) format files. The application fails to sanitize the user input resulting in a memory corruption, overwriting several memory registers which can aid the attacker to gain the power of executing arbitrary code on the affected system or denial of service scenario.
004516d691bbf0e327eed6642cae5fbeToko Lite CMS version 1.5.2 suffers from a HTTP response splitting vulnerability. Input passed to the 'charSet' parameter in 'edit.php' is not properly sanitized before being returned to the user. This can be exploited to insert arbitrary HTTP headers, which are included in a response sent to the user.
34672c438690517a794e2988f0aa13cbToko Lite CMS version 15.2 suffers from multiple cross site scripting vulnerabilities.
2cf5a6a9043d77e534c287aa0742d39ciGallery plugin version 1.0.0 suffers from a cross site scripting vulnerability when parsing user input to the 'dir' parameter via GET method in '/scripts/pthumb/demo/phpThumb.demo.random.php'. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.
dc66196499f702c5331ab7e24d62ef74iManager plugin versions 1.2.8 build 02012008 and below suffer from a cross site scripting vulnerability when parsing user input to the 'dir' parameter via GET method in 'random.php' and 'phpThumb.demo.random.php'. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.
045faa0e1a51102fa891c0e22e0c6e8aiBrowser plugin versions 1.4.1 and below suffer from a cross site scripting vulnerability.
9c5932f540901235e8b6fa62aa3e4f98iManager plugin version 1.2.8 suffers from an arbitrary file deletion vulnerability.
ee52d4adfa39e998606fa5b8245f162biManager plugin version 1.2.8 suffers from a local file inclusion vulnerability / file disclosure vulnerability when input passed thru the 'lang' parameter to imanager.php, rfiles.php, symbols.php, colorpicker.php, loadmsg.php, ov_rfiles.php and examples.php is not properly verified before being used to include files. This can be exploited to include files from local resources with directory traversal attacks and URL encoded NULL bytes.
1f565d16d37a5af74ffc5e704832da2eiBrowser plugin version 1.4.1 suffers from a local file inclusion vulnerability / file disclosure vulnerability when input passed thru the 'lang' parameter to ibrowser.php, loadmsg.php, rfiles.php and symbols.php is not properly verified before being used to include files. This can be exploited to include files from local resources with directory traversal attacks and URL encoded NULL bytes.
21c69e820a3468c7dd0b243efc200013Mini FTP Server version 1.1 buffer corruption remote denial of service exploit.
ae5338d23b34f5ad338332bbc123fd00ManageEngine ServiceDesk Plus version 8.0 suffers from multiple cross site scripting vulnerabilities.
1e00cc8ab3d183d83551ed37a8a419e5ATutor version 2.0.2 suffers from a HTTP response splitting vulnerability.
65493a36e142e548a77b004ccc82dc10ATutor version 2.0.2 suffers from cross site scripting, path disclosure, and remote SQL injection vulnerabilities.
ab2df9c6d8a9277cbfbf7362c5db1e1eATutor AChecker version 1.2 suffers from cross site scripting and path disclosure vulnerabilities.
1dfcb0308b1fc9f621d64e75cb0ec0b3ATutor AChecker version 1.2 suffers from multiple remote SQL injection vulnerabilities.
475954b621b8571b3fe1b0e3220801ddATutor AContent version 1.1 suffers from a script insertion vulnerability.
2478dac5eb13b92fa34347528cf29390ATutor AContent version 1.1 suffers from multiple cross site scripting vulnerabilities. This also affects version 1.3 as of 2014/01/05.
ccfe3c05bd73e4627c487bfb8dfe62edATutor AContent version 1.1 suffers from multiple remote SQL injection vulnerabilities.
3385f97fa7a85cf1d63e00960be6b12eDigital Scribe version 1.5 suffers from multiple post cross site scripting vulnerabilities. Input thru the POST parameters 'title', 'last' and 'email' in register.php is not sanitized allowing the attacker to execute HTML code into user's browser session on the affected site.
06f72ee6189d18849ce8c40b4cd30f27
© 2020 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed