WordPress Plugin Huge-IT Image Gallery 1.8.9 - Multiple Vulnerabilities

WordPress Plugin Huge-IT Image Gallery 1.8.9 - Multiple Vulnerabilities Exploit Title: WordPress plugin Image Gallery Full Path Disclosure and SQL Injection Google Dork: inurl:"wp-content/plugins/gallery-images/" Date: 12-05-2016 Software Link: https://fr.wordpress.org/plugins/gallery-images/...

WordPress Q and A Focus Plus FAQ Plugin 1.3.9.7 - Multiple Vulnerabilities

Q and A Focus Plus FAQ plugin is prone to full path disclosure and SQL injection vulnerabilities. Solution Upgrade the plugin...

WordPress Huge-IT Image Gallery 1.8.9 Plugin - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WordPress plugin Image Gallery Full Path Disclosure and SQL Injection Google Dork: inurl:"wp-content/plugins/gallery-images/" Date: 12-05-2016 Software Link: https://fr.wordpress.org/plugins/gallery-images/ Version: 1.8.9 and...

WordPress Q&A (Focus Plus) FAQ Plugin 1.3.9.7 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WordPress Q and A Focus Plus FAQ Full Path Disclosure and SQL Injection Google Dork: inurl:"wp-content/plugins/q-and-a" Date: 12-05-2016 Software Link: https://wordpress.org/plugins/q-and-a-focus-plus-faq/ Version: 1.3.9.7 and...

WordPress Plugin Q and A (Focus Plus) FAQ 1.3.9.7 - Multiple Vulnerabilities

WordPress Plugin Q and A Focus Plus FAQ 1.3.9.7 - Multiple Vulnerabilities Exploit Title: WordPress Q and A Focus Plus FAQ Full Path Disclosure and SQL Injection Google Dork: inurl:"wp-content/plugins/q-and-a" Date: 12-05-2016 Software Link: https://wordpress.org/plugins/q-and-a-focus-plus-faq/...

WordPress Plugin Q and A (Focus Plus) FAQ 1.3.9.7 - Multiple Vulnerabilities

Exploit Title: WordPress Q and A Focus Plus FAQ Full Path Disclosure and SQL Injection Google Dork: inurl:"wp-content/plugins/q-and-a" Date: 12-05-2016 Software Link: https://wordpress.org/plugins/q-and-a-focus-plus-faq/ Version: 1.3.9.7 and prior Exploit Author: Gwendal Le Coguic Website:...

WordPress Plugin Huge-IT Image Gallery 1.8.9 - Multiple Vulnerabilities

Exploit Title: WordPress plugin Image Gallery Full Path Disclosure and SQL Injection Google Dork: inurl:"wp-content/plugins/gallery-images/" Date: 12-05-2016 Software Link: https://fr.wordpress.org/plugins/gallery-images/ Version: 1.8.9 and prior Exploit Author: Gwendal Le Coguic Website:...

Uber: Multiple vulnerabilities in a WordPress plugin at drive.uber.com

Hi again, The story begins when I started looking at https://drive.uber.com/ukmarketplace/welcome/, at the first glance I noticed that you are running WordPress 4.4.2 which you probably know is outdated now 1https://codex.wordpress.org/Version4.5Security . So first you need to update to the lates...

Uber: Full path disclosure on track.uber.com

The page at track.uber.com had verbose stack traces enabled, allowing an attacker to learn information about the libraries, technologies and system information used in Uber Rush. Thanks, @firs0v!...

Multiple vulnerabilities in extension phpMyAdmin (phpmyadmin)

It has been discovered that the extension "phpMyAdmin" phpmyadmin is susceptible to unsafe comparison of XSRF/CSRF token, multiple full path disclosure vulnerabilities, multiple XSS vulnerabilities, insecure password generation in JavaScript. Release Date: March 10, 2016 Component Type: Third par...

Fedora 22 : phpMyAdmin-4.5.4-1.fc22 (2016-e1fe01e96e)

phpMyAdmin 4.5.4 2016-01-28 ============================= - live data edit of big sets is not working - Table list not saved in db QBE bookmarked search - While 'changing a column', query fails with a syntax error after the 'CHARSET=' keyword - Avoid syntax error in JavaScript messages on invalid...

Fedora 23 : phpMyAdmin-4.5.4.1-1.fc23 (2016-e55278763e)

phpMyAdmin 4.5.4.1 2016-01-28 =============================== - Error with PMA 4.4.15.3 - Remove hard dependency on phpseclib phpMyAdmin 4.5.4 2016-01-28 ============================= - live data edit of big sets is not working - Table list not saved in db QBE bookmarked search - While 'changing ...

Paragon Initiative Enterprises: Full Path Disclosure In EasyDB

Hi, as reported in 115337 about a full path disclosure in EasyDB you fixed some of them in last commits but single function is vulnerable too and not fixed yet! ifcount$params != count$params,COUNTRECURSIVE throw new \InvalidArgumentException"Invalid params"; this will check $params to be 1d arra...

UBUNTU-CVE-2016-2044

libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message...

CVE-2016-2038

phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message...

openSUSE Security Update : phpMyAdmin 4.4.15.4 (openSUSE-2016-168)

Security update to phpMyAdmin 4.4.15.4 The followinng vulnerabilities were fixed: boo964024 - CVE-2016-2038: Multiple full path disclosure vulnerabilities - CVE-2016-2039: Unsafe generation of XSRF/CSRF token - CVE-2016-2040: Multiple XSS vulnerabilities - CVE-2016-1927: Insecure password...

Paragon Initiative Enterprises: Full Path Disclosure

Hi as reported in email, there is a full path disclosure in EasyDB you fixed some of them in last commit add this code before and "execute$params" function call! ifcount$params != count$params,COUNTRECURSIVE throw new \InvalidArgumentException"Invalid params"; this will check $params to be 1d...

openSUSE Security Update : phpMyAdmin (openSUSE-2016-151)

This update to phpMyAdmin 4.4.15.4 fixes the following issues boo964024 - CVE-2016-2038: Multiple full path disclosure vulnerabilities - CVE-2016-2039: Unsafe generation of XSRF/CSRF token - CVE-2016-2040: Multiple XSS vulnerabilities - CVE-2016-1927: Insecure password generation in JavaScript -...

FreeBSD : phpmyadmin -- Full path disclosure vulnerability in SQL parser (78b4ebfb-c60b-11e5-bf36-6805ca0b3d42)

The phpMyAdmin development team reports : By calling a particular script that is part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. We consider this vulnerability...

FreeBSD : phpmyadmin -- Multiple full path disclosure vulnerabilities (5d6a204f-c60b-11e5-bf36-6805ca0b3d42)

The phpMyAdmin development team reports : By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. We consider these vulnerabilities to...