199 matches found
Catalyst Mahara Mobile Information Disclosure Vulnerability
Catalyst Mahara Mobile is a suite of mobile social networking software from Catalyst IT in New Zealand. A security vulnerability exists in versions of Catalyst Mahara Mobile prior to 1.2.1, which stems from the program sending passwords in clear text to the access log. An attacker could exploit t...
CVE-2017-1000171
Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text...
CVE-2017-1000171
Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text...
CVE-2017-1000171
Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text...
Vesta Control Panel 0.9.8-15 Cross Site Scripting
Exploit Title :Vesta Control Panel " http://victimserver 3. We wait Administrator to read access.log that injected our evil.js 4. We log-in VestaCP via password we changed https:...
Internet Bug Bounty: PHP-FPM fpm_log.c memory leak and buffer overflow
The FastCGI Process Manager FPM SAPI of PHP was vulnerable to memory leak and buffer overflow in the access logging feature. PHP-FPM offers customization of the access log lines based on format string variables which can be specified with the access.format option of the FPM configuration file. Th...
冰峰VPN /log/system.log 敏感信息泄漏漏洞
由于“ICEFLOW VPN Router”设备产品存在各种日志文件未授权访问可导致系统敏感信息泄漏。（包括登录成功后的session值） 系统日志http://url/log/system.log VPN日志http://url/log/vpn.log 移动用户日志http://url/log/mobile.log 防火墙日志http://url/log/firewall.log 访问日志http://url/log/access.log 告警日志http://url/log/warn.log 错误日志http://url/log/error.log...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Research Artisan Lite before 1.18 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted HTML document or 2 a crafted URL that is mishandled during access-log analysis...
CVE-2015-2976
Multiple cross-site scripting XSS vulnerabilities in Research Artisan Lite before 1.18 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted HTML document or 2 a crafted URL that is mishandled during access-log analysis...
CVE-2015-2976
Multiple cross-site scripting XSS vulnerabilities in Research Artisan Lite before 1.18 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted HTML document or 2 a crafted URL that is mishandled during access-log analysis...
CVE-2015-2976
CVE-2015-2976 affects Research Artisan Lite prior to 1.18. The provided documents confirm multiple cross-site scripting (XSS) vulnerabilities (CWE-79) that can allow remote attackers to inject arbitrary scripts via either a crafted HTML document or a crafted URL processed during access-log analys...
Malware cleanup to Gravity Forms arbitrary file upload-vulnerability warning-the black bar safety net
Regular malware detection cleanup process, we encountered one case of infection, caused our attention. Our environment does not have any special or fancy stuff, just updated wordpress and 3 expired plug-in; this situation is quite reasonable. The processing process ends, the environment is clean...
EMC Captiva Capture InputAccel Database Information Disclosure Vulnerability
EMC Captiva Capture is a suite of data capture software. The software captures documents and data from files, electronic documents and other sources and transforms them into digital content delivery with content management systems and business processes. A security vulnerability in the InputAccel...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 datefilter parameter in the accesslog page to wp-admin/users.php or 2 simplesecurityipblacklist...
Webfroot Shoutbox 2.32 Remote Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7746/info Shoutbox is prone to an issue that may result in the execution of attacker-supplied code. The vulnerability exists due to insufficient sanitization of the 'conf' URI parameter. An attacker can exploit this...
PHP-Nuke Module Addressbook 1.2 - Local File Inclusion Exploit
No description provided by source. !Perl PHP-Nuke Module Addressbook 1.2 Local File Inclusion Exploit Vendor: http://www.sb-websoft.com/index.php?name=CmodsDownload&file=index&req=getit&lid=14 Vulnerable Code: requireoncemodules/$modulename/include/func.inc.php; Coded by bd0rk || SOH-Crew Greetz:...
Greenwood Content Manager 0.3.2 - Local File Inclusion Exploit
No description provided by source. !usr/bin/python Greenwood Content Manager Remote Code Execution AUTHOR : Sina Yazdanmehr R3d.W0rm Discovered by : Sina Yazdanmehr R3d.W0rm Our Site : http://ircrash.com My Official WebSite : http://r3dw0rm.ir IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm...
Webfroot Shoutbox < 2.32 (Apache) Remote Exploit
No description provided by source. !/usr/bin/perl Webfroot Shoutbox 2.32 on apache exploit use IO::Socket; my $host = 127.0.0.1; my $port = 80; my $shoutbox = shoutbox.php?conf=; my $shoutboxpath = /shoutbox; my $cmd = ls -l; my $conn; my $type; my @logs = /etc/httpd/logs/acceslog,...
Maian Gallery 2 - Local File Download Vulnerability
No description provided by source. !/usr/bin/python This vulnerability uses filegetcontents so we have some limitations, we cant execute PHP and we cant read files that the web server will interpret such as PHP, conf etc tested on: Ubuntu Linux 2.6.32 with php v5.3.2 registerglobals = Off PRIVATE...
phpMyAgenda <= 3.1 (templates/header.php3) Local File Include Exploit
No description provided by source. !/usr/bin/perl use IO::Socket; use LWP::Simple; print \n; print \n; print \n; print phpMyAgenda 3.1 Multiple Remote Vulnerabilities Exploit \n; print Bug found By : Ashiyane Corporation \n; print Email: Nima Salehi nimaatashiyane.ir \n; print Web Site :...