Adobe Captivate Quiz Reporting Feature 'internalserverread.php' Remote File Disclosure (APSB17-19)

The Adobe Captivate application running on the remote web server is affected by a remote file disclosure vulnerability in the quiz reporting feature due to improper validation of parameters passed to the 'internalserverread.php' script. An unauthenticated, remote attacker can exploit this issue,...

CVE-2017-2182

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a different vulnerability than CVE-2017-2179 and CVE-2017-2181...

CVE-2017-2181

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a different vulnerability than CVE-2017-2179 and CVE-2017-2182...

Hands-on AppGoat Information Disclosure Vulnerability

AppGoat is a vulnerability experiential learning tool from IPA Japan that can be used to learn about relevant web application vulnerabilities and enable interactive learning. An information disclosure vulnerability exists in Hands-on AppGoat 3.0.2 and earlier versions, which could allow an attack...

Automattic: SSRF and local file disclosure in https://wordpress.com/media/videos/ via FFmpeg HLS processing

Summary FFmpeg is a video encoding software that appears to be used by wordpress.com for video processing for paid accounts. FFmpeg is known to process HLS playlists that may contain references to external files. I was able to fire this feature using GAB2 subtitle chunks inside an AVI file. After...

WordPress Plugin Tribulant Newsletters 4.6.4.2 - File Disclosure Cross-Site Scripting

WordPress Plugin Tribulant Newsletters 4.6.4.2 - File Disclosure Cross-Site Scripting DefenseCode WebScanner DAST Advisory WordPress Tribulant Newsletters Plugin Multiple Security Vulnerabilities Advisory ID: DC-2017-01-012 Advisory Title: WordPress Tribulant Newsletters Plugin Multiple...

WordPress Plugin Tribulant Newsletters 4.6.4.2 - File Disclosure / Cross-Site Scripting

DefenseCode WebScanner DAST Advisory WordPress Tribulant Newsletters Plugin Multiple Security Vulnerabilities Advisory ID: DC-2017-01-012 Advisory Title: WordPress Tribulant Newsletters Plugin Multiple Vulnerabilities Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress...

WordPress Tribulant Newsletters 4.6.4.2 XSS / File Disclosure

DefenseCode WebScanner DAST Advisory WordPress Tribulant Newsletters Plugin Multiple Security Vulnerabilities Advisory ID: DC-2017-01-012 Advisory Title: WordPress Tribulant Newsletters Plugin Multiple Vulnerabilities Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress...

Multiple Hitachi Products XML External Entity Information Disclosure Vulnerability

Hitachi Device Manager is a suite of mobile device management software; Replication Manager is a suite of data replication software that simplifies Hitachi storage systems. An XML external entity information disclosure vulnerability exists in multiple Hitachi products. A remote attacker could...

Trend Micro Deep Security has multiple vulnerabilities

Trend Micro Deep Security is server and application protection software that unifies security across virtual, cloud and traditional data center environments. Trend Micro Deep Security has multiple vulnerabilities. Vulnerabilities can be exploited by attackers to cause arbitrary file disclosure,...

Tribulant Newsletters <= 4.6.4.2 – Multiple Vulnerabilities

The Newsletters WordPress plugin was affected by security vulnerability. PoC 3.1 File disclosure Vulnerable URL: http://vulnerablesite.com/wp-admin/admin.php?page=newslettershistory=exportdownload=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cWIN DOWS%5cwin.ini 3.2 Cross-Site Scripting...

Contao Directory Traversal Vulnerability

Contao is an open source content management system CMS developed using PHP. The system supports search engine , rights management and CSS framework . A directory traversal vulnerability exists in Contao versions prior to 3.2.19 and 3.4.x prior to 3.4.4. A remote attacker can exploit this...

OV3 Online Administration 3.0 - Directory Traversal

OV3 Online Administration 3.0 - Directory Traversal OV3 Online Administration 3.0 Parameter Traversal Arbitrary File Access PoC Exploit Vendor: novaCapta Software & Consulting GmbH Product web page: http://www.meacon.de Affected version: 3.0 Summary: With the decision to use the OV3 as a platform...

Tribulant Newsletters <= 4.6.4.2 – Multiple Vulnerabilities

The Newsletters WordPress plugin was affected by security vulnerability. 3.1 File disclosure Vulnerable URL: http://vulnerablesite.com/wp-admin/admin.php?page=newslettershistory&wpmlmethod=exportdownload&file=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cWIN DOWS%5cwin.ini 3.2 Cross-Site...

OV3 Online Administration 3.0 - Directory Traversal

OV3 Online Administration 3.0 Parameter Traversal Arbitrary File Access PoC Exploit Vendor: novaCapta Software & Consulting GmbH Product web page: http://www.meacon.de Affected version: 3.0 Summary: With the decision to use the OV3 as a platform for your data management, the course is set for...

OV3 Online Administration 3.0 Parameter Traversal Arbitrary File Access PoC Exploit

Summary With the decision to use the OV3 as a platform for your data management, the course is set for scalable, flexible and high-performance applications. Whether you use the OV3 for your internal data management or use it for commercial business applications such as shops, portals, etc. Thanks...

WordPress Tribulant Newsletters plugin <=4.6.4.2 - File Disclosure vulnerability

WordPress Tribulant Newsletters plugin version 4.6.4.2 and earlier are prone to File Disclosure vulnerability. Vulnerability found by Neven Biruski DefenseCode. Solution Update WordPress Tribulant Newsletters plugin to the latest available version...

XXE Vulnerability in KnowledgeSort.asmx File of MicroXia Online Learning Platform

Micro Xia Online Learning Platform is an online education system based on B/S architecture. A XXE vulnerability exists in the KnowledgeSort.asmx file of MicroXia Online Learning Platform, which can be exploited by an attacker to remotely read arbitrary files from the server...

Directory Traversal

Overview Affected versions of serveryaozeyan resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable...

XXE Vulnerability in Columns.asmx File of Microxia Online Learning Platform

Micro Xia Online Learning Platform is an online education system based on B/S architecture. A XXE vulnerability exists in the Columns.asmx file of MicroXia Online Learning Platform. An attacker can exploit the vulnerability to remotely read arbitrary files on the server...