1897 matches found
WordPress Huge-IT Image Gallery Plugin 1.8.9 - Multiple Vulnerabilities
Multiple vulnerabilities were found in Huge-IT Image Gallery 1.8.9 plugin. 1 It's prone to a SQL injection vulnerability 2 Also, there's a Full Path Disclosure vulnerability. Solution Update Huge-IT Image Gallery plugin to 1.9.0 version...
WordPress Plugin Q and A (Focus Plus) FAQ 1.3.9.7 - Multiple Vulnerabilities
Exploit Title: WordPress Q and A Focus Plus FAQ Full Path Disclosure and SQL Injection Google Dork: inurl:"wp-content/plugins/q-and-a" Date: 12-05-2016 Software Link: https://wordpress.org/plugins/q-and-a-focus-plus-faq/ Version: 1.3.9.7 and prior Exploit Author: Gwendal Le Coguic Website:...
WordPress Plugin Q and A (Focus Plus) FAQ 1.3.9.7 - Multiple Vulnerabilities
WordPress Plugin Q and A Focus Plus FAQ 1.3.9.7 - Multiple Vulnerabilities Exploit Title: WordPress Q and A Focus Plus FAQ Full Path Disclosure and SQL Injection Google Dork: inurl:"wp-content/plugins/q-and-a" Date: 12-05-2016 Software Link: https://wordpress.org/plugins/q-and-a-focus-plus-faq/...
WordPress Huge IT Image Gallery Plugin 1.8.9 - Multiple Vulnerabilities
Huge IT Image Gallery plugin is prone to full path disclosure and SQL injection vulnerabilities. Solution Upgrade the plugin...
WordPress Plugin Huge-IT Image Gallery 1.8.9 - Multiple Vulnerabilities
Exploit Title: WordPress plugin Image Gallery Full Path Disclosure and SQL Injection Google Dork: inurl:"wp-content/plugins/gallery-images/" Date: 12-05-2016 Software Link: https://fr.wordpress.org/plugins/gallery-images/ Version: 1.8.9 and prior Exploit Author: Gwendal Le Coguic Website:...
Uber: Multiple vulnerabilities in a WordPress plugin at drive.uber.com
Hi again, The story begins when I started looking at https://drive.uber.com/ukmarketplace/welcome/, at the first glance I noticed that you are running WordPress 4.4.2 which you probably know is outdated now 1https://codex.wordpress.org/Version4.5Security . So first you need to update to the lates...
Uber: Full path disclosure on track.uber.com
The page at track.uber.com had verbose stack traces enabled, allowing an attacker to learn information about the libraries, technologies and system information used in Uber Rush. Thanks, @firs0v!...
Mozilla Firefox Sensitive Information Disclosure Vulnerability (CNVD-2016-01683)
Firefox is an open source web browser. Mozilla Firefox suffers from a sensitive information disclosure vulnerability due to Content Security Policy CSP reports containing full path information, which allows remote attackers to exploit the vulnerability to build malicious WEB pages that can be...
Multiple vulnerabilities in extension phpMyAdmin (phpmyadmin)
It has been discovered that the extension "phpMyAdmin" phpmyadmin is susceptible to unsafe comparison of XSRF/CSRF token, multiple full path disclosure vulnerabilities, multiple XSS vulnerabilities, insecure password generation in JavaScript. Release Date: March 10, 2016 Component Type: Third par...
Fedora 22 : phpMyAdmin-4.5.4-1.fc22 (2016-e1fe01e96e)
phpMyAdmin 4.5.4 2016-01-28 ============================= - live data edit of big sets is not working - Table list not saved in db QBE bookmarked search - While 'changing a column', query fails with a syntax error after the 'CHARSET=' keyword - Avoid syntax error in JavaScript messages on invalid...
Fedora 23 : phpMyAdmin-4.5.4.1-1.fc23 (2016-e55278763e)
phpMyAdmin 4.5.4.1 2016-01-28 =============================== - Error with PMA 4.4.15.3 - Remove hard dependency on phpseclib phpMyAdmin 4.5.4 2016-01-28 ============================= - live data edit of big sets is not working - Table list not saved in db QBE bookmarked search - While 'changing ...
Paragon Initiative Enterprises: Full Path Disclosure In EasyDB
Hi, as reported in 115337 about a full path disclosure in EasyDB you fixed some of them in last commits but single function is vulnerable too and not fixed yet! ifcount$params != count$params,COUNTRECURSIVE throw new \InvalidArgumentException"Invalid params"; this will check $params to be 1d arra...
DEBIAN-CVE-2016-2044
libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message...
UBUNTU-CVE-2016-2044
libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message...
CVE-2016-2038
phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message...
CVE-2016-2042
phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to 1 libraries/phpseclib/Crypt/AES.php or 2 libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message...
openSUSE Security Update : phpMyAdmin 4.4.15.4 (openSUSE-2016-168)
Security update to phpMyAdmin 4.4.15.4 The followinng vulnerabilities were fixed: boo964024 - CVE-2016-2038: Multiple full path disclosure vulnerabilities - CVE-2016-2039: Unsafe generation of XSRF/CSRF token - CVE-2016-2040: Multiple XSS vulnerabilities - CVE-2016-1927: Insecure password...
Paragon Initiative Enterprises: Full Path Disclosure
Hi as reported in email, there is a full path disclosure in EasyDB you fixed some of them in last commit add this code before and "execute$params" function call! ifcount$params != count$params,COUNTRECURSIVE throw new \InvalidArgumentException"Invalid params"; this will check $params to be 1d...
openSUSE Security Update : phpMyAdmin (openSUSE-2016-151)
This update to phpMyAdmin 4.4.15.4 fixes the following issues boo964024 - CVE-2016-2038: Multiple full path disclosure vulnerabilities - CVE-2016-2039: Unsafe generation of XSRF/CSRF token - CVE-2016-2040: Multiple XSS vulnerabilities - CVE-2016-1927: Insecure password generation in JavaScript -...
