Design/Logic Flaw

cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor SEC-385...

CVE-2018-20949

cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor SEC-385...

CVE-2018-20885

cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation SEC-416...

SUSE-SU-2018:1448-1 Security update for openstack-nova

This update for openstack-nova fixes the following bugs and security issues: The following security-issue has been fixed: - CVE-2017-18191: libvirt: Block swap volume attempts with encrypted volumes. bsc1081685 Additionally, the following bugs have been fixed: - Set TasksMax to infinity for...

Configuration Modification

October CMS is vulnerable to configuration modification. The library does not validate the type of files allowed to be uploaded, allowing a malicious user to upload malicious Apache configuration files to the server...

CVE-2017-1000194

October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server...

CVE-2017-1000194

October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server...

CVE-2017-1000194

October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server...

October CMS Apache Configuration Modification Vulnerability

OctoberCMS is a CMS system based on Laravel PHP development framework. October CMS build 412 suffers from an Apache configuration modification vulnerability. The vulnerability can be exploited to compromise a website and other applications on the server via the file upload feature...

Nextcloud: Banner Grabbing - Apache Server Version Disclousure

Hello Nextcloud, I'd like to report a nice little bug. Banner Grabbing is a technique used to gain information about a remote server. Additionally, this technique is use to get information about remote servers. I've captured the HTTP request while visiting https://customerupdates.nextcloud.com an...

CVE-2017-0199: Microsoft Office RTF vulnerability using the PoC-vulnerability warning-the black bar safety net

0x01 description From FireFye detect and publish CVE-2017-0199 since, I have been researching this vulnerability in Microsoft officially released the patch, I decided to release this PoC. I use way possible with other researchers using different methods, the use of the method may be little bit...

Multiple vulnerabilities in ZoneMinder

ZoneMinder is an open source video surveillance system. An information disclosure and authentication bypass vulnerability exists in the Apache HTTP server configuration in ZoneMinder version 1.30.0. An unauthenticated remote attacker can exploit the vulnerability to browse all web root directorie...

DEBIAN-CVE-2016-10140

Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCT...

Nextcloud: Content spoofing due to the improper behavior of the 403 page in Private Server

@ahsantahir reported a content spoofing vulnerability on an internal server. We've fixed this by adjusting the Apache configuration. On request of the reporter this is disclosed limitedly...

Nextcloud: Information Disclosure of .htaccess file in Private Server/Subdomain

@ahsantahir reported a missing permission check on an internal service allowing the extraction of the .htaccess file. We've fixed this by adjusting the Apache configuration and putting Basic Auth in front of the page. On request of the reporter this is disclosed limitedly. Non-Critical, small...

Nextcloud: Content spoofing in cloud.nextcloud.com

@ahsantahir reported a content spoofing vulnerability in cloud.nextcloud.com caused by it's Apache configuration. This has been changed by adding the following to the Apache config: ErrorDocument 404 "File not ErrorDocument 403 "Access forbidden." On request of the reporter, this issue is only...

JShielder - LAMP/LEMP Secure Deployment

JSHielder is an Open Source tool developed to help SysAdmin and developers secure there Linux Servers in which they will be deploying any web application. This tool automates the process of installing all the necessary packages to host a web application and Hardening a Linux server with little...

CouchCMS 1.4.5 Code Execution

Security Advisory - Curesec Research Team 1. Introduction Affected Product: CouchCMS 1.4.5 Fixed in: 1.4.7 Fixed Version Link: http://www.couchcms.com/products/ Vendor Website: http://www.couchcms.com/ Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to vendor: 11/17/2015...

Ubiquiti Inc.: JetBrains .idea project directory

Vulnerability description The .idea directory contains a set of configuration files .xml for your project. These configuration files contain information core to the project itself, such as names and locations of its component modules, compiler settings, etc. If you've defined a data source the fi...

ClickHeat 1.13+ - Remote Command Execution

Clickheat 1.13+ Unauthenticated RCE ----------------------------------- The Clickheat developers have been informed, but have not responded to my email. The code has not been updated recently and the project seems to be in an abandoned state. I have discovered a vulnerability in Clickheat 1.13...