463 matches found
CVE-2014-5094
CVE-2014-5094 affects Status2k Server Monitoring Software. The vulnerability stems from a phpinfo call in status/index.php, which is reachable remotely and leads to disclosure of configuration information. Multiple connected sources (NVD/NVD-derived entries, OpenVAS/ExploitDB references, and thir...
CVE-2014-5094
Status2k allows remote attackers to obtain configuration information via a phpinfo action in a request to status/index.php, which calls the phpinfo function...
Information disclosure
The EasyCart wp-easycart plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function...
CVE-2014-4942
The EasyCart wp-easycart plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function...
Clever Copy 3.0 Connect.INC Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/17461/info Clever Copy is prone to an information-disclosure vulnerability. A remote attacker could leverage this issue to gain access to sensitive configuration information. The attacker could then use this information t...
Netbilling NBMEMBER Script Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/11504/info Netbilling 'nbmember.cgi' script is reported prone to an information disclosure vulnerability. This issue may allow remote attackers to gain access to user authentication credentials and potentially sensitive...
Achievo 0.7/0.8/0.9 - Remote File Include Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5552/info Achievo includes a PHP script which is used to generate JavaScript class.atkdateattribute.js.php. This script employs a number of PHP includeonce statements to call code contained in function libraries and grab...
Linksys Devices 1.42/1.43 GET Request Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6301/info Several Linksys Broadband Router devices are prone to a buffer overflow conditions. The vulnerability occurs due to insufficient allocation of memory for buffers. An attacker can exploit this vulnerability by...
大汉jbook、jget、jvideo、source、jphoto和lm的通用越权漏洞
简要描述： jbook=订阅系统（好像是） source=数据源采集系统 jget=信息采集系统 jvideo=视频系统 jphoto=图片系统 lm=互动系统 大概就是这样。 详细说明： 某个同名文件虽然代码大同小异，但是都产生了同样的越权漏洞，可以重置这几个系统的安装目录相关配置信息。 漏洞证明： None 先用jphoto来做例子。 http://www.yzwh.gov.cn/jphoto/setup/ 这是jphoto的setup目录，先用exp提交数据： 提交成功后，提示配置文件修改完成，重启服务。 Exp里面是把密码设置为123456的...
Level One Enterprise Access Point (Multiple Devices) - backupCfg.cgi Security Bypass
Level One Enterprise Access Point Multiple Devices - backupCfg.cgi Security Bypass source: https://www.securityfocus.com/bid/63168/info Multiple Level One Enterprise Access Point devices are prone to a security bypass vulnerability. Successfully exploiting this issue may allow an attacker to gain...
Resource file path traversal in WebImagesDownloadResourceManager
To reproduce: 1. Create a new page named foo any name can be used, but it must match the markup in step 3 2. In the editor, create an unmigrated-wiki-markup macro by typing "\a" don't copy/paste 3. Replace the "\a" in the macro with: code:none foo|foo|" code 4. Save the page. 5. Export to word...
Resource file path traversal in WebImagesDownloadResourceManager
To reproduce: 1. Create a new page named foo any name can be used, but it must match the markup in step 3 2. In the editor, create an unmigrated-wiki-markup macro by typing "\a" don't copy/paste 3. Replace the "\a" in the macro with: code:none foo|foo|" code 4. Save the page. 5. Export to word...
Resource file path traversal in IconDownloadResourceManager
To reproduce: 1. Create a new page title doesn't matter. 2. Insert an image with URL: code:none /confluence/images/icons/profilepics/../../../WEB-INF/classes/crowd.properties code with /confluence/ replaced with the correct base path. Edit the page, click +, click Image, select the From the Web...
Amazon Linux AMI : puppet (ALAS-2012-135)
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. dot dot in a...
CVE-2013-0943
EMC NetWorker 7.6.x and 8.x before 8.1 allows local users to obtain sensitive configuration information by leveraging operating-system privileges to perform decryption with nsradmin...
Design/Logic Flaw
EMC NetWorker 7.6.x and 8.x before 8.1 allows local users to obtain sensitive configuration information by leveraging operating-system privileges to perform decryption with nsradmin...
CVE-2013-0943
EMC NetWorker 7.6.x and 8.x before 8.1 allows local users to obtain sensitive configuration information by leveraging operating-system privileges to perform decryption with nsradmin...
KLA10146 OSI vulnerability in EMC NetWorker
An unspecified vulnerability was found in EMC NetWorker. By exploiting this vulnerability malicious users can obtain configuration information. This vulnerability can be exploited locally. Original advisories - Related products EMC-NetWorker CVE list CVE-2013-0943 warning Solution Update to lates...
Choice Wireless Green Packet 4G WiMax modem vulnerability
Overview Choice Wireless Green Packet 4G WiMax modem, model number WIXFMR-111, fails to properly validate ajax requests allowing a remote unauthenticated attacker to view system configuration information or possibly execute commands on the device. Description It has been reported that Choice...