Alibaba Clone B2B Script - Arbitrary File Disclosure

Alibaba Clone B2B Script - Arbitrary File Disclosure Exploit Title: Alibaba Clone B2B Script File Read Vulnerability Date: 2016-06-22 Exploit Author: Meisam Monsef [email protected] or [email protected] Vendor Homepage: http://alibaba-clone.com/ Version: All Versions Tested on: CentOS and...

RIPS automated mining Typecho source code security vulnerabilities-vulnerability warning-the black bar safety net

RIPS is a source code analysis tool, which uses static analysis technology to automate the mining of the PHP source code for potential security vulnerabilities. Penetration testers can directly easily review the results of the analysis, without review of the entire program code. Since static sour...

Oracle GlassFish Server Multiple Vulnerabilities (Nov 2016) - Active Check

Oracle GlassFish Server is prone to multiple remote file disclosure vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

SAP NetWeaver AS Java 7.5 XXE in com.sap.km.cm.ice

Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver AS Java 7.5 Vendor URL: SAP Bugs: XXE Reported: 17.06.2016 Vendor response: 18.06.2016 Date of Public Advisory: 11.04.2017 Reference: SAP Security Note 2387249 Author: Mathieu Geli ERPScan VULNERABILITY INFORMATION Class: XXE...

CVE-2016-4494

Cross-site request forgery CSRF vulnerability on KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allows remote attackers to hijack the authentication of unspecified victims for requests that disclose the contents of a configuration file...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability on KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allows remote attackers to hijack the authentication of unspecified victims for requests that disclose the contents of a configuration file...

CVE-2016-4494

CVE-2016-4494 affects KMC Controls BAC-5051E routers with firmware prior to E0.2.0.2. The vulnerability is a cross-site request forgery (CSRF) that allows an unauthenticated or remote attacker to hijack a user’s session and read the device’s configuration contents via the web interface. Connected...

Pornhub: [RCE] Unserialize to XXE - file disclosure on ams.upload.pornhub.com

Researcher was able to exploit a serialization error in the SimpleXMLElement class to perform object injection using the callbackUrl parameter. Researcher was successful in achieving the following: SSRF Local file inclusion Limited execution of database commands without output I exploited the...

TYPO3 Form Component Arbitrary File Disclosure Vulnerability (TYPO3-CORE-SA-2016-010)

TYPO3 is prone to arbitrary file disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3";...

Sierra Wireless AceManager File Disclosure Vulnerability (ICSA-16-105-01) - Active Check

Sierra Wireless AceManager is prone to a file disclosure vulnerability SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

LimeSurvey 2.05x < 2.06+ Multiple Vulnerabilities

LimeSurvey is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:limesurvey:limesurvey"; if...

Important: Red Hat Security Advisory: Red Hat OpenShift Enterprise 3.2 security, bug fix, and enhancement update

Red Hat OpenShift Enterprise 3.2 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Ajaxel CMS 8.0 - Multiple Vulnerabilities

Ajaxel CMS 8.0 Multiple Vulnerabilities Vendor: Ajaxel Product web page: http://www.ajaxel.com Affected version: 8.0 and below Summary: Ajaxel CMS is very simple ajaxified CMS and framework for any project needs. Desc: Ajaxel CMS version 8.0 and below suffers from multiple vulnerabilities inlcudi...

Ajaxel CMS 8.0 XSS / CSRF / File Disclosure / SQL Injection

Ajaxel CMS 8.0 Multiple Vulnerabilities Vendor: Ajaxel Product web page: http://www.ajaxel.com Affected version: 8.0 and below Summary: Ajaxel CMS is very simple ajaxified CMS and framework for any project needs. Desc: Ajaxel CMS version 8.0 and below suffers from multiple vulnerabilities inlcudi...

Uber: Information Disclosure on lite.uber.com

Hello, according to your policy https://hackerone.com/uber?viewpolicy=true, you are looking for Local File Disclosure. And lite.uber.com also in scope for your program. request: GET https://lite.uber.com/auth/login HTTP/1.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.11; rv:42.0...

Webnet CMS 1.2 XSS / File Disclosure / SQL Injection

Exploit Title : Webnet CMS Multiple Vulnerabilities Exploit Author : Persian Hack Team Vendor Homepage : http://www.webnet.ir/ Homepage : http://www.persian-team.ir Date: 2016/04/15 Version : 1.2 POC: 1-LFDLocal File Dislocation Explain : ids Parameter encode base64 Path , you can use...

Arbitrary File Disclosure in Form Component

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-010/...

CVE-2016-0162

Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka “Internet Explorer Information Disclosure Vulnerability.” Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

Arbitrary File Disclosure in Form Component

It has been discovered, that TYPO3 Form Component is susceptible to Arbitrary File Disclosure. Component Type: TYPO3 CMS Release Date: April 12, 2016 Vulnerable subcomponent: Form Vulnerability Type: Arbitrary File Disclosure Affected Versions: Versions 6.2.0 to 6.2.19 Severity: High Suggested CV...

WordPress Plugin IMDb Profile Widget 1.0.8 - Local File Inclusion

Exploit Title: Wordpress Plugin IMDb Profile Widget - Local File Inclusion Exploit Author: CrashBandicot @DosPerl Date: 2016-03-26 Google Dork : inurl:/wp-content/plugins/imdb-widget Vendor Homepage: https://wordpress.org/plugins/imdb-widget/ Tested on: MSWin32 Version: 1.0.8 Vuln file : pic.php...