PHP <=5.3 - preg_match() full path disclosure

No description provided by source. MajorSecurity Advisory 57PHP =5.3 - pregmatch full path disclosure Details ======= Product: PHP =5.3 Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.php.net/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered b...

PHP 5.3 - 'preg_match()' Full Path Disclosure

MajorSecurity Advisory 57PHP =5.3 - pregmatch full path disclosure Details ======= Product: PHP =5.3 Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.php.net/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David Vieira-Kurz...

PHP 5.3 - preg_match() Full Path Disclosure

PHP 5.3 - pregmatch Full Path Disclosure MajorSecurity Advisory 57PHP =5.3 - pregmatch full path disclosure Details ======= Product: PHP =5.3 Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.php.net/ Vendor-Status: informed Advisory-Status: published Credits ============...

Vulnerabilities in FileDownload Snippet for MODx

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Directory Traversal и Full path disclosure уязвимостях в FileDownload Snippet для MODx. Directory Traversal: http://site/assets/snippets/filedownload/download.php?path=YnVpbGRz&fileName=../index.php Данная уязвимость может использоваться для...

Vulnerabilities in Dumb math captcha for WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Insufficient Anti-automation и Full path disclosure уязвимостях в плагине Dumb math captcha для WordPress. Insufficient Anti-automation: Капча на страницах записей уязвима к Constant values bypass method, который я описал в проекте Month of Bugs i...

CSRF, SQL Injection and Full path disclosure vulnerabilities in XAMPP

Hello 3APA3A! I want to warn you about new security vulnerabilities in XAMPP. These are Cross-Site Request Forgery, SQL Injection and Full path disclosure vulnerabilities. CSRF: http://site/xampp/cds-fpdf.php It's possible to delete or add data in test table as via CSRF, and as via Insufficient...

Cross-Site Scripting, CSRF, SQL Injection and Full path disclosure vulnerabilities in XAMPP

Hello 3APA3A! I want to warn you about new security vulnerabilities in XAMPP which I found at 23.06.2009. These are Cross-Site Scripting, Cross-Site Request Forgery, SQL Injection and Full path disclosure vulnerabilities. XSS:...

[ISecAuditors Security Advisories] Joomla! < 1.5.12 Multiple Full Path Disclosure vulnerabilities

============================================= INTERNET SECURITY AUDITORS ALERT 2009-009 - Original release date: July 21st, 2009 - Last revised: July 23rd, 2009 - Discovered by: Juan Galiana Lara - Severity: 5/10 CVSS Base Score ============================================= I. VULNERABILITY...

Vulnerabilities in CMS SiteLogic

Здравствуйте 3APA3A! Сообщаю вам о найденных мною SQL Injection, Full path disclosure и Cross-Site Scripting уязвимостях в CMS SiteLogic. SQL Injection: http://site/index.php?mid=-120union20select201,1,version,1,1,1,1,1 Full path disclosure: http://site/index.php?mid=’ http://site/includes/stat.p...

Unclassified NewsBoard 1.6.4 SQL Injection / Disclosure

Author girex Homepage girex.altervista.org Date 31/05/2009 CMS Unclassified NewsBoard 1.6.4 and maybe lower Dork "This board is powered by the Unclassified NewsBoard software, 1.6.4" Multiple remote vulnerabilities 1 Remote SQL Injection php.ini regardless 2 Logs File Disclosure registerglobals =...

unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities

unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities Author girex Homepage girex.altervista.org Date 31/05/2009 CMS Unclassified NewsBoard 1.6.4 and maybe lower Dork "This board is powered by the Unclassified NewsBoard software, 1.6.4" Multiple remote vulnerabilities 1 Remote SQL Injection...

Unclassified NewsBoard 1.6.4 Multiple Remote Vulnerabilities

No description provided by source. Author girex Homepage girex.altervista.org Date 31/05/2009 CMS Unclassified NewsBoard 1.6.4 and maybe lower Dork "This board is powered by the Unclassified NewsBoard software, 1.6.4" Multiple remote vulnerabilities 1 Remote SQL Injection php.ini regardless 2 Log...

Unclassified NewsBoard 1.6.4 Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ============================================================ Unclassified NewsBoard 1.6.4 Multiple Remote Vulnerabilities ============================================================ Author girex Date 31/05/2009 CMS Unclassified NewsBoard...

unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities

Author girex Homepage girex.altervista.org Date 31/05/2009 CMS Unclassified NewsBoard 1.6.4 and maybe lower Dork "This board is powered by the Unclassified NewsBoard software, 1.6.4" Multiple remote vulnerabilities 1 Remote SQL Injection php.ini regardless 2 Logs File Disclosure registerglobals =...

Multiple vulnerabilities in YaBook

Здравствуйте 3APA3A! Сообщаю вам о найденных мною SQL Injection, Redirector, HTTP Response Splitting, Information Leakage и Full path disclosure уязвимостях в YaBook. SQL Injection: http://site/guestbook/index.php?action=jump&id=-120union20select20version Redirector через SQL Injection:...

activeCollab XSS and Full Path Disclosure

activeCollab XSS and Full Path Disclosure Vuln. discovered by : r0t Date: 17 May 2009 Vendor:http://www.activecollab.com/ affected versions:2.1, corporate other versions also can be affected. orginal advisory: http://pridels-team.blogspot.com/2009/05/activecollab-xss-and-full-path.html 1.Cross-Si...

Vulnerabilities in OpenX

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Full path disclosure, Cross-Site Scripting и Redirector уязвимостях в OpenX. Full path disclosure: http://site/openx/www/delivery/fc.php?MAXtype=1 XSS: http://site/openx/www/delivery/fc.php?MAXtype=3Cscript3Ealertdocument.cookie3C/script3E XSS обх...

Multiple vulnerabilities in Webglimpse

Здравствуйте 3APA3A! Сообщаю вам о найденных мною множественных уязвимостях в Webglimpse. Это Full path disclosure, Cross-Site Scripting, Directory Traversal и Authorization bypass уязвимости. Уязвимости в админке Webglimpse в которую можно попасть через гостевой аккаунт, или захватив кукис админ...

Invision Power Board (IP.Board) 3.0.0b5 - Active Cross-Site Scripting Full Path Disclosure

Invision Power Board IP.Board 3.0.0b5 - Active Cross-Site Scripting Full Path Disclosure ================================================================================ Found : brainpillow Dork : "Powered By IP.Board 3.0.0 Beta 5" Visit : brainpillow.cc, forum.antichat.ru, raz0r.name Greetz:...

Invision Power Board (IP.Board) 3.0.0b5 - Active Cross-Site Scripting / Full Path Disclosure

================================================================================ Found : brainpillow Dork : "Powered By IP.Board 3.0.0 Beta 5" Visit : brainpillow.cc, forum.antichat.ru, raz0r.name Greetz: slider, halkfild, m0nzt3r, c411k, ettee Mail : [email protected] Note: works on IE 6,7,8...