QIWI: [id.rapida.ru] Full Path Disclosure

Уязвимый сценарий: dp.php Включено отображение подробной информации об ошибках. При использовании массива вместо строки выводится полный путь до веб директории. Примеры путей: ██████████████████ ███████ █████████ Примеры запросов: Пример 1 нужно подставить валидное значение сессии http POST /dp.p...

Security update for phpMyAdmin (important)

phpMyAdmin was updated to version 4.4.15.8 2016-08-16 to fix the following issues: - Upstream changelog for 4.4.15.8: Improve session cookie code for openid.php and signon.php example files Full path disclosure in openid.php and signon.php example files Unsafe generation of BlowfishSecret when no...

OLX: full path disclosure vulnerability at https://security.olx.com/*

in form of html comment it disclosing full path of file name Security.html in all https://security.olx.com/ links...

WordPress Count Per Day Plugin <= 3.2.3 - Full Path Disclosure

This plugin is prone to multiple script direct request path disclosure vulnerability. Solution Update the plugin...

Shopify: (FULL PATH DISCLOSURE) Unknown MySQL server host 'shardm-reader.chi2.shopify.io'

Hello, Found a website of you guys that is poiting to: shardm-reader.chi2.shopify.io' This domain is disclosure fill path because there is none MySQL server host. POC: https://104.196.154.1/ Response a whole page with path disclosures: lib/patches/mysqlmonitoring.rb:19:in connect'...

Ian Dunn: [Not just a server configuration issue] Full Path Disclosure

Hey, I've just found a 'full path disclosure' in basic-google-maps-placemarks, so it's not just a server configuration issue! I've tested it on different servers including windows, ubuntu, CentOS etc.. PoC So, if we visit wp-content/plugins/basic-google-maps-placemarks/unit-tests.php it is clearl...

Paragon Initiative Enterprises: Full Path Disclosure by removing CSRF token

Hello, you can get an error and full path disclosure by following these steps: on any user generated POST request such as during login, or changing user data remove the CSRF token from the post request entirely. For example, on the login POST request,...

ExpressionEngine: Full path + some back-end code disclosure

Hello, Ironically enough, I just discovered a full path disclosure issue. When an admin edits their personal information, a request like the following gets sent: POST /ee/admin.php?/cp/members/profile/settings&id=1 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664; rv:45.0...

OpenDocMan v1.3.5 - Full Path Disclosure Vulnerability

Document Title: =============== OpenDocMan v1.3.5 - Full Path Disclosure Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1868 Release Date: ============= 2016-07-04 Vulnerability Laboratory ID VL-ID: ==================================== 186...

Joomla com_jotloader - Full Path Disclosure Vulnerability

No description provided by source...

DEBIAN-CVE-2016-5730

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving 1 an array value to FormDisplay.php, 2 incorrect data to validate.php, 3 unexpected data to Validator.php, 4 a missing config directory...

Paragon Initiative Enterprises: Full path disclosure when CSRF validation failed

Hi again , There are Full path disclosure in airship when the CSRF validation failed . It will show the full path with files this is can be useful for an attacker if he need some information about files and path ,identified the script and path . PoC : Host: bridge.cspr.ng User-Agent: Mozilla/5.0...

openSUSE Security Update : phpMyAdmin (openSUSE-2016-806)

This phpMyAdmin update to version 4.4.15.7 fixes the following issues : Issues fixed: Setup script doesn't use input type 'password' in all relevant locations Security issues fixed : - PMASA-2016-17 CVE-2016-5701, CWE-661 https://www.phpmyadmin.net/security/PMASA-2016-17/ - BBCode injection...

phpMyAdmin Full Path Disclosure Vulnerability

phpmyadmin is an online management tool for MySQL databases. phpmyadmin versions 4.4.x, 4.6.x, 4.0.x are available at . /setup/, . /examples/ are vulnerable to a full path disclosure vulnerability, which can be exploited by an attacker with a constructed script that triggers a PHP error message t...

Multiple full path disclosure vulnerabilities

PMASA-2016-23 Announcement-ID: PMASA-2016-23 Date: 2016-06-23 Summary Multiple full path disclosure vulnerabilities Description This PMASA contains information on multiple full-path disclosure vulnerabilities reported in phpMyAdmin. By specially crafting requests in the following areas, it is...

phpATM 1.32 - Multiple Vulnerabilities

!-- Exploit Title : "phpATM = 1.32 Multiple CSRF Vulnerabilities & Full Path Disclosure Vulnerability" Date : 17/06/2016 Author : Paolo Massenio - pmassenioATgmail Vendor : phpATM - http://phpatm.org/ Version : = 1.32 Tested on : Windows 10 with XAMPP 1 CSRF in configure.php phpATM lets the...

phpATM 1.32 - Multiple Vulnerabilities

phpATM 1.32 - Multiple Vulnerabilities !-- Exploit Title : "phpATM = 1.32 Multiple CSRF Vulnerabilities & Full Path Disclosure Vulnerability" Date : 17/06/2016 Author : Paolo Massenio - pmassenioATgmail Vendor : phpATM - http://phpatm.org/ Version : = 1.32 Tested on : Windows 10 with XAMPP 1 CSRF...

Joomla Joomdoc 4.0.3 Path Disclosure

Exploit Title : Joomla comjoomdoc - Full Path Disclosure Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://extensions.joomla.org/extension/joomdoc Category: Webapps Tested on: Win Version: 4.0.3 Date: 2016/06/08 PoC: Full Path Disclosure FPD vulnerabilities enable the...

WordPress Huge IT Image Gallery Plugin 1.8.9 - Multiple Vulnerabilities

Huge IT Image Gallery plugin is prone to full path disclosure and SQL injection vulnerabilities. Solution Upgrade the plugin...

WordPress Plugin Huge-IT Image Gallery 1.8.9 - Multiple Vulnerabilities

Exploit Title: WordPress plugin Image Gallery Full Path Disclosure and SQL Injection Google Dork: inurl:"wp-content/plugins/gallery-images/" Date: 12-05-2016 Software Link: https://fr.wordpress.org/plugins/gallery-images/ Version: 1.8.9 and prior Exploit Author: Gwendal Le Coguic Website:...