498 matches found
WordPress Miwo FTP Plugin <= 1.0.4 - Arbitrary File Disclosure
Because of this vulnerability, users can download a file within the scope of the home directory of the site. Solution Update this plugin...
WordPress IP Blacklist Cloud Plugin <= 3.42 - Arbitrary File Disclosure
This plugin is prone to an arbitrary file disclosure vulnerability. It allows an user with adequate access to the WordPress instance to read files on the system and potentially compromising further credentials such as FTP, MySQL, amongst other sensitive information. Solution Upgrade the plugin...
IP Blacklist Cloud <= 3.42 - Arbitrary File Disclosure
The IP Blacklist Cloud plugin exposes several AJAX functions to users. One of these is the ‘importCSVIPCloud’ action, which looks to be used to import CSV files into the systems blacklist. This action is susceptible to Directory Traversal, and does not check file extensions, as such it is possibl...
[RT-SA-2014-016] Directory Traversal and Arbitrary File Disclosure in hybris Commerce Software Suite
Advisory: Directory Traversal and Arbitrary File Disclosure in hybris Commerce Software Suite During a penetration test, RedTeam Pentesting discovered a Directory Traversal vulnerability in hybris Commerce software suite. This vulnerability allows attackers to download arbitrary files of any size...
Hybris Commerce Software Suite 5.x File Disclosure / Traversal
Advisory: Directory Traversal and Arbitrary File Disclosure in hybris Commerce Software Suite During a penetration test, RedTeam Pentesting discovered a Directory Traversal vulnerability in hybris Commerce software suite. This vulnerability allows attackers to download arbitrary files of any size...
Fedora 20 : rubygem-sprockets-2.8.2-5.fc20 (2014-15489)
Contains fix for CVE-2014-7819 rubygem-sprockets: arbitrary file existence disclosure Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...
Tiny Server 1.1.9 - Arbitrary File Disclosure Exploit
Usage Info python exploit.py http://127.0.0.1:80 flag.txt -- coding: utf-8 -- import urllib2 import sys Tiny Server v1.1.9 Arbitrary File Disclosure Exploit def banner: print "\0331m\03392mTiny Server v1.1.9 Arbitrary File Disclosure Exploit" print "Exploit Write by Yahya Tanisik" print "Contact ...
SysAid < 14.4.2 Arbitrary File Disclosure Vulnerability
SysAid On-Premise is prone to an arbitrary file disclosure vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Cart66 Pro <= 1.5.3 - Authenticated Arbitrary File Disclosure
Ability to change settings with a registered non-admin user allows us to trigger an Arbitrary File Disclosure vulnerability with any path of our choosing. One limitation with this vulnerability is that the target user in the PoC, ‘test’ needs to have an account on the Cart66 installation...
VP-2014-004 SysAid Server Arbitrary File Disclosure
Vantage Point Security Advisory 2014-004 ======================================== Title: SysAid Server Arbitrary File Disclosure ID: VP-2014-004 Vendor: SysAid Affected Product: SysAid On-Premise Affected Versions: 14.4.2 Product Website: http://www.sysaid.com/product/sysaid Author: Bernhard...
WordPress Sell Downloads Plugin <= 1.0.1 - Arbitrary File Disclosure
Because of this vulnerability, attackers can download arbitrary files from site, under the context of the web server. Solution Upgrade the plugin...
SysAid Server Arbitrary File Disclosure Vulnerability
SysAid Server is vulnerable to an unauthenticated file disclosure attack that allows an anonymous attacker to read arbitrary files on the system. An attacker exploiting this issue can compromise SysAid user accounts and gain access to important system files. When SysAid is configured to use LDAP...
Tiny HTTP Server <= 1.1.9 Path Traversal Vulnerability - Active Check
Tiny HTTP server is prone to a path traversal vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Tiny Server 1.1.9 - Arbitrary File Disclosure Exploit
Exploit for windows platform in category remote exploits !/usr/bin/perl -w Title : Tiny Server v1.1.9 Arbitrary File Disclosure Exploit Download : http://tinyserver.sourceforge.net/tinyserverfull.zip Author : ZoRLu Test : Windows7 Ultimate Date : 29/11/2014 BkiAdam : Dr.Ly0n, KnocKout, LifeSteaLe...
Ruby on Rails: Arbitrary file existence disclosure in Action Pack
This bug was reported directly to the Rails team: https://groups.google.com/forum/!topic/rubyonrails-security/23fiuwb1NBA...
Arbitrary file existence disclosure in Action Pack
Specially crafted requests can be used to determine whether a file exists on the filesystem that is outside the Rails application's root directory. The files will not be served, but attackers can determine whether or not the file exists...
Aerohive Hive Manager and Hive OS Multiple Vulnerabilities
, , . '.' '. ', . , '. , .', , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. Aerohive Hive Manager and Hive OS Multiple Vulnerabilities Affected Versions: Aerohive Hive Manager Stand-alone and Cloud = 6.1R3 and HiveOS 6.1R3 PDF:...
Vtiger CRM <= 6.0.0 Arbitrary File Disclosure Vulnerability
Vtiger CRM is prone to an arbitrary file disclosure vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Advanced XML Reader 0.1.1 - XML External Entity (XXE) Data Parsing Arbitrary File Disclosure
The advanced-xml-reader WordPress plugin was affected by a XML External Entity XXE Data Parsing Arbitrary File Disclosure security vulnerability...