163 matches found
CVE-2017-1000194
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server...
CVE-2017-1000194
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server...
CVE-2017-1000194
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server...
CVE-2017-1000194
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server...
October CMS Apache Configuration Modification Vulnerability
OctoberCMS is a CMS system based on Laravel PHP development framework. October CMS build 412 suffers from an Apache configuration modification vulnerability. The vulnerability can be exploited to compromise a website and other applications on the server via the file upload feature...
PT-2017-10891
Name of the Vulnerable Software and Affected Versions October CMS build 412 Description The issue allows for Apache configuration modification via file upload functionality, which can result in site compromise and potentially affect other applications on the server. Recommendations For October CM...
CVE-2017-1000194: Unrestricted Upload of File with Dangerous Type
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server...
Nextcloud: Banner Grabbing - Apache Server Version Disclousure
Hello Nextcloud, I'd like to report a nice little bug. Banner Grabbing is a technique used to gain information about a remote server. Additionally, this technique is use to get information about remote servers. I've captured the HTTP request while visiting https://customerupdates.nextcloud.com an...
CVE-2017-0199: Microsoft Office RTF vulnerability using the PoC-vulnerability warning-the black bar safety net
0x01 description From FireFye detect and publish CVE-2017-0199 since, I have been researching this vulnerability in Microsoft officially released the patch, I decided to release this PoC. I use way possible with other researchers using different methods, the use of the method may be little bit...
Multiple vulnerabilities in ZoneMinder
ZoneMinder is an open source video surveillance system. An information disclosure and authentication bypass vulnerability exists in the Apache HTTP server configuration in ZoneMinder version 1.30.0. An unauthenticated remote attacker can exploit the vulnerability to browse all web root directorie...
DEBIAN-CVE-2016-10140
Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCT...
Nextcloud: Content spoofing due to the improper behavior of the 403 page in Private Server
@ahsantahir reported a content spoofing vulnerability on an internal server. We've fixed this by adjusting the Apache configuration. On request of the reporter this is disclosed limitedly...
Nextcloud: Information Disclosure of .htaccess file in Private Server/Subdomain
@ahsantahir reported a missing permission check on an internal service allowing the extraction of the .htaccess file. We've fixed this by adjusting the Apache configuration and putting Basic Auth in front of the page. On request of the reporter this is disclosed limitedly. Non-Critical, small...
Nextcloud: Content spoofing in cloud.nextcloud.com
@ahsantahir reported a content spoofing vulnerability in cloud.nextcloud.com caused by it's Apache configuration. This has been changed by adding the following to the Apache config: ErrorDocument 404 "File not ErrorDocument 403 "Access forbidden." On request of the reporter, this issue is only...
JShielder - LAMP/LEMP Secure Deployment
JSHielder is an Open Source tool developed to help SysAdmin and developers secure there Linux Servers in which they will be deploying any web application. This tool automates the process of installing all the necessary packages to host a web application and Hardening a Linux server with little...
CouchCMS 1.4.5 Code Execution
Security Advisory - Curesec Research Team 1. Introduction Affected Product: CouchCMS 1.4.5 Fixed in: 1.4.7 Fixed Version Link: http://www.couchcms.com/products/ Vendor Website: http://www.couchcms.com/ Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to vendor: 11/17/2015...
Ubiquiti Inc.: JetBrains .idea project directory
Vulnerability description The .idea directory contains a set of configuration files .xml for your project. These configuration files contain information core to the project itself, such as names and locations of its component modules, compiler settings, etc. If you've defined a data source the fi...
ClickHeat 1.13+ - Remote Command Execution
Clickheat 1.13+ Unauthenticated RCE ----------------------------------- The Clickheat developers have been informed, but have not responded to my email. The code has not been updated recently and the project seems to be in an abandoned state. I have discovered a vulnerability in Clickheat 1.13...
SUSE-RU-2015:0462-1 Recommended update for crowbar-barclamp-nova_dashboard
This update for crowbar-barclamp-novadashboard provides stability fixes from the upstream OpenStack project: Use a host specific memcache key for djangocompressor bnc894070 Add Requires on crowbar-barclamp-openstack for the new crowbar-openstack cookbook. Use helpers from new crowbar-openstack...
Twiki Upload Bypass
This is an advisory for TWiki administrators: Attaching a specially named file allows remote upload of an Apache configuration file. This applies to native TWiki installations on Windows, the TWiki-VM virtual machine running in a Windows server environment is not affected. TWiki http://twiki.org ...