4732 matches found
Design/Logic Flaw
The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining which configuration file to use...
CVE-2014-5019
The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining which configuration file to use...
CVE-2014-5019
CVE-2014-5019 affects Drupal 6.x before 6.32 and 7.x before 7.29, where the multisite feature can be abused by a crafted HTTP Host header to cause a denial of service (DoS) by impacting configuration file selection. The connected advisories confirm the issue and indicate fixes were released as Dr...
Xen 3.0.3 pygrub TOOLS/PYGRUB/SRC/GRUBCONF.PY Local Command Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/25825/info Xen is prone to a local command-injection vulnerability that can lead to privilege escalation. This issue occurs because the application fails to validate input in the 'tools/pygrub/src/GrubConf.py' script. Thi...
Apple QuickTime/Darwin Streaming MP3Broadcaster 0 ID3 Tag Handling Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7660/info MP3Broadcaster is shipped as part of Darwin Streaming Server software. MP3Broadcaster has been reported prone to a vulnerability when processing malicious ID3 tags. This is likely due to insufficient sanity chec...
Frox 0.7.18 Arbitrary Configuration File Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/14711/info Frox is prone to a vulnerability that permits read access to arbitrary files. Successful exploitation of this vulnerability will grant the attacker read access to arbitrary files on the system in the security...
KDE 1.1.2 KApplication configfile vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/1291/info The KDE configuration-file management has a bug which could result in root compromise. Due to insecure creation of configuration rc files via KApplication-class, local users can modify ownership of arbitrary fil...
Invision Board 1.1.1 ipchat.php Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6976/info Invision Board is prone to an issue that may allow remote attackers to include files located on attacker-controlled servers. This vulnerability is as a result of insufficient sanitization performed on remote use...
PHPSlash 0.5.3 2/0.6.1 URL Block Arbitrary File Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2724/info PHPSlash is a widely used open source Groupware utility. PHPSlash contains a vulnerability which may disclose files readable to the webserver process on the underlying host to PHPSlash users who can 'edit' URL...
EZ Publish 2.2.7/3.0 site.ini Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7347/info eZ Publish has been reported prone to sensitive information disclosure vulnerability. An attacker may make a request for and download the underlying site.ini configuration file. The file contains eZ Publish...
W-Agora 4.1.x Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4977/info W-Agora is prone to an issue which may allow an attacker to include arbitrary files located on a remote server. In particular, the 'incdir' variable found in a number of the W-Agora scripts defines the path to t...
TS Special Edition <= 7.0 - Multiple Vulnerabilities
No description provided by source. TS Special Edition = v.7.0 Multiple Vulnerabilities Dork: Powered by TS Special Edition Site: http://templateshares.net Download: http://templateshares.net/special/purchase Reported on 02/05/2010 Author: IHTeam See any seed/leech files of any users 1 Open any...
MyBlog 0.9.8 Multiple Remote Information Disclosure Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/30310/info MyBlog is prone to multiple information-disclosure vulnerabilities because the application fails to properly restrict access to sensitive files. An unprivileged attacker may exploit these issues to obtain...
AutomatedShops WebC 2.0/5.0 Symbolic Link Following Configuration File Weakness
No description provided by source. source: http://www.securityfocus.com/bid/7272/info It has been reported that WebC will execute in the directory of a symbolic link from which it is invoked. Because of this, it may be possible for a local user to load a configuration file that enabled dangerous...
BibORB 1.3.2 index.php Traversal Arbitrary File Manipulation
No description provided by source. source: http://www.securityfocus.com/bid/12583/info BibORB is reported prone to multiple vulnerabilities arising from insufficient sanitization of user-supplied input. These issues can be exploited by a remote attacker to carry out cross-site scripting, HTML...
Working Resources 1.7.3 BadBlue Null Byte File Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5226/info BadBlue is a P2P file sharing application distributed by Working Resources. It is available for Microsoft Windows operating systems. It has been discovered that a request passed to a BadBlue server containing a...
Netgear FM114P Wireless Firewall File Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6807/info Netgear FM114P Wireless Firewalls allow directory traversal using escaped character sequences. It is possible for an unauthenticated user to retrieve the firewall's configuration file by escaping from the...
SuSE Linux Professional 8.2 SuSEWM Configuration File Insecure Temporary File Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8778/info A problem exists in the SuSEWM configuration file used by SuSEConfig. Because of this, it may be possible for a local attacker to gain elevated privileges. / Proof of Concept for SuSEconfig.vmware Symbolic Link...
TightAuction 3.0 Config.INC Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5850/info TightAuction is prone to an information disclosure vulnerability. The configuration file config.inc contains sensitive information such as database authentication credentials. It is possible for remote attackers...
Play! Framework <= 1.0.3.1 Directory Transversal Vulnerability
No description provided by source. Exploit Title: Play! Framework = 1.0.3.1 Directory Transversal Vulnerability Date: July 24, 2010 Author: kripthor Software Link: http://www.playframework.org/ Version: Play! Framework = 1.0.3.1 Tested on: Ubuntu 10 CVE : N/A Notes: 28/07/2010 at 14:03 - Develope...