149 matches found
AjaxExplorer 1.10.3.2 - Multiple Vulnerabilities
Exploit for php platform in category web applications + Credits: hyp3rlinx + ISR: apparitionsec Vendor: ========== sourceforge.net smsid download linx: sourceforge.net/projects/ajax-explorer/files/ Product: ======================= AjaxExplorer v1.10.3.2 Manage server files through simple windows...
Paragon Initiative Enterprises: file full path discloser.
Hi, Paragonie security team i found one directory browsing vulnerability in php-encryption-master where the user input will not been filtered from any security layer. let me show you. there is a autoload.php page in the php-encryption-master. where the input src will b used to browse the director...
Directory Browsing Enabled on /cgi-bin (deprecated)
The /cgi-bin directory on the remote web server is browsable. An unauthenticated, remote attacker can exploit this to disclose sensitive information. This plugin has been deprecated. Use webmirror3.nbin plugin ID 10662 instead to identify browsable directories. %NASLMINLEVEL 999999 C Tenable...
Netsweeper 4.0.8 - Multiple Vulnerabilities
Exploit for php platform in category web applications +---------------------------------------------------+ + Netsweeper 4.0.8 - Cross Site Scripting Injection + +---------------------------------------------------+ Affected Product: Netsweeper Vendor Homepage : www.netsweeper.com/ Version : 4.0....
Hosting Controller <= 0.6.1 Hotfix 1.4 Directory Browsing Vulnerability
No description provided by source. Advisory Information ------------------------- Software Package : Hosting Controller Vendor Homepage : http://www.hostingcontroller.com Platforms : Windows based servers Vulnerable Versions : All version Tested on: v.6.1 Hotfix 1.4 Vendor Contacted : 12/5/2004...
MinaliC Webserver 2.0 - Remote Source Disclosure
No description provided by source. Exploit Title : MinaliC Webserver v2.0 Remote Source Disclosure Software link : http://sourceforge.net/projects/minalic/ Version : 2.0 Tested on : Windows 7 Home Premium Date : 27/07/2011 Author : X-h4ck Website : http://www.pirate.al ,...
DDIVRT-2013-53 Actuate 'ActuateJavaComponent' Multiple Vulnerabilities
Title ----- DDIVRT-2013-53 Actuate 'ActuateJavaComponent' Multiple Vulnerabilities Severity -------- High Date Discovered --------------- March 19, 2013 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: Dennis Lavrinenko, Bobby Lockett, and r@b13$ 1. Actuate...
W3 Total Cache Plugin for WordPress Cache File Direct Request Information Disclosure
The W3 Total Cache Plugin for WordPress installed on the remote host is affected by an information disclosure vulnerability because it stores cache files in a publicly accessible directory. If directory browsing is enabled on a web server, an attacker can browse to /wp-content/w3tc/dbcache and...
Bugzilla < 3.6.11 / 4.0.8 / 4.2.3 / 4.3.3 Multiple Vulnerabilities
According to its banner, the version of Bugzilla installed on the remote host is affected by multiple vulnerabilities : - When the user logs in using LDAP, the username is not escaped when building the uid=$username filter which is used to query the LDAP directory. This could potentially lead to...
FreeBSD : bugzilla -- multiple vulnerabilities (6ad18fe5-f469-11e1-920d-20cf30e32f6d)
A Bugzilla Security Advisory reports : The following security issues have been discovered in Bugzilla : LDAP Injection When the user logs in using LDAP, the username is not escaped when building the uid=$username filter which is used to query the LDAP directory. This could potentially lead to LDA...
Security advisory for Bugzilla 4.3.3, 4.2.3, 4.0.8 and 3.6.11
Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: When the user logs in using LDAP, the username is not escaped before being passed to LDAP which could potentially lead to LDAP...
bugzilla -- multiple vulnerabilities
A Bugzilla Security Advisory reports: The following security issues have been discovered in Bugzilla: LDAP Injection When the user logs in using LDAP, the username is not escaped when building the uid=$username filter which is used to query the LDAP directory. This could potentially lead to LDAP...
'/users/userpicker.action' exposes users loginids and full names in instance with anonymous access enabled
quote LDAP directory users and groups exposed via the /users/userpicker.action. There should be an option to restrict this to authenticated users only and perhaps this should be the default behavior. quote quote The second exposed function that is part of this vulnerability is...
'/users/userpicker.action' exposes users loginids and full names in instance with anonymous access enabled
quote LDAP directory users and groups exposed via the /users/userpicker.action. There should be an option to restrict this to authenticated users only and perhaps this should be the default behavior. quote quote The second exposed function that is part of this vulnerability is...
CVE-2011-4435
The web-server component in the Consolidation and Analysis Engine CAE Server in DB2 Query Monitor in IBM DB2 Tools 2.3.0 for z/OS does not prevent directory browsing, which allows remote attackers to obtain sensitive information via HTTP requests...
CVE-2011-4435
The web-server component in the Consolidation and Analysis Engine CAE Server in DB2 Query Monitor in IBM DB2 Tools 2.3.0 for z/OS does not prevent directory browsing, which allows remote attackers to obtain sensitive information via HTTP requests...
CVE-2011-4435
The web-server component in the Consolidation and Analysis Engine CAE Server in DB2 Query Monitor in IBM DB2 Tools 2.3.0 for z/OS does not prevent directory browsing, which allows remote attackers to obtain sensitive information via HTTP requests...
CVE-2011-4435
CVE-2011-4435 affects the web-server component of the Consolidation and Analysis Engine (CAE) Server in IBM DB2 Tools 2.3.0 for z/OS. The issue is that directory browsing is not prevented, enabling remote attackers to obtain sensitive information via HTTP requests. CVSSv2 metrics indicate a Netwo...
PT-2011-4952
Name of the Vulnerable Software and Affected Versions IBM DB2 Tools version 2.3.0 for z/OS Description The issue concerns the web-server component in the Consolidation and Analysis Engine CAE Server in DB2 Query Monitor, which fails to prevent directory browsing. This allows remote attackers to...
CVE-2011-4435: Undefined Security Weakness
The web-server component in the Consolidation and Analysis Engine CAE Server in DB2 Query Monitor in IBM DB2 Tools 2.3.0 for z/OS does not prevent directory browsing, which allows remote attackers to obtain sensitive information via HTTP requests...