Уязвимости в теме Live Wire Edition для WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, Full path disclosure, Abuse of Functionality и Denial of Service уязвимостях в теме Live Wire Edition для WordPress. Это коммерческий шаблон для WP. XSS WASC-08:...

The Gazette Edition Cross Site Scripting

Hello list! I want to warn you about Cross-Site Scripting, Full path disclosure, Abuse of Functionality and Denial of Service vulnerabilities in The Gazette Edition theme for WordPress. It's commercial theme for WP by WooThemes. ------------------------- Affected products: -----------------------...

Viscacha 0.8.1 Multiple Vulnerabilities

Exploit for php platform in category web applications Product: Viscacha Vendor: MaMo Net http://www.viscacha.org Vulnerable Version: 0.8.1 Vendor Notification: 24 March 2011 Vulnerability Type: SQL Injection Risk level: High Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing...

Live Wire 2.3.1 XSS / Disclosure / Denial Of Service

Hello list! I want to warn you about Cross-Site Scripting, Full path disclosure, Abuse of Functionality and Denial of Service vulnerabilities in Live Wire Edition theme for WordPress. It's commercial theme for WP by WooThemes. ------------------------- Affected products: -------------------------...

Уязвимости в Artefact St. CMS

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, Brute Force и Full path disclosure уязвимостях в системе Artefact St. CMS. Это украинская коммерческая CMS. XSS WASC-08: http://site/search/?s=3Cscript3Ealertdocument.cookie3C/script3E Brute Force WASC-11: http://site/admin/...

Joomla! 1.6.0 | Information Disclosure/Full Path Disclosure Vulnerability

Joomla! 1.6.0 | Information Disclosure/Full Path Disclosure Vulnerability 1. OVERVIEW Joomla! 1.6.0 is vulnerable to Full Path Disclosure. 2. BACKGROUND Joomla is a free and open source content management system CMS for publishing content on the World Wide Web and intranets. It comprises a...

HTB22892: Path disclosure in Smen Social Button wordpress plugin

Vulnerability ID: HTB22892 Reference: http://www.htbridge.ch/advisory/pathdisclosureinsmensocialbuttonwordpressplugin.html Product: Smen Social Button wordpress plugin Vendor: Alexandru Dumencu http://smen.ro/ Vulnerable Version: 0.7 Vendor Notification: 03 March 2011 Vulnerability Type: Path...

BoutikOne Multiples SQL Injection Vulnerability

BoutikOne - Multiples SQL Injection Vulnerability RELEASE DATE : 13.03.2011 by Alz cdxdotsecurityatgmaildotcom - Google Dork: "Powered by BoutikOne" - categorie.php Var path : http://target/categories.php?path=sqli - list.php Var path : http://target/list.php?path=sqli - description.php Var id :...

BoutikOne Multiple SQL Injections

BoutikOne - Multiples SQL Injection Vulnerability RELEASE DATE : 13.03.2011 by Alz categorie.php Var : http://target/categories.php?path=sqli - list.php Var : http://target/list.php?path=sqli - description.php Var : http://target/description.php?id=sqli - description.php Var :...

Уязвимости в PHPIDS

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Full path disclosure и Information Leakage уязвимостях в PHPIDS. Full path disclosure WASC-13: http://site/script.php?p=’ При отправке "атакующего" запроса такого как с одиночной кавычкой к любому php-скрипту на сайте с PHPIDS выводится полный пут...

Tribiq CMS 5.2.7b Path Disclosure

Vulnerability ID: HTB22857 Reference: http://www.htbridge.ch/advisory/fullpathdisclosureintribiqcms.html Product: Tribiq CMS Vendor: Tribal Limited http://tribiq.com/ Vulnerable Version: 5.2.7b and probably prior versions Vendor Notification: 17 February 2011 Vulnerability Type: Path disclosure...

PHPIDS 0.6.5 Path Disclosure / Information Leakage

Hello list! I want to warn you about Full path disclosure and Information Leakage vulnerabilities in PHPIDS. ------------------------- Affected products: ------------------------- Vulnerable are PHPIDS 0.6.5 and previous versions. ---------- Details: ---------- Full path disclosure WASC-13:...

Уязвимости в phpMyAdmin

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Brute Force и Full path disclosure уязвимостях в phpMyAdmin. CVE id: CVE-2011-0986. Brute Force WASC-11: http://site/phpmyadmin/ В форме логина нет защиты от Brute Force атак. Full path disclosure WASC-13: http://site/phpmyadmin/readme.php если не...

FlatNux 2011-01.26 Denial Of Service / Path Disclosure

===================================== Vulnerability ID: HTB22835 Reference: http://www.htbridge.ch/advisory/dosdenialofserviceriskinflatnux.html Product: FlatNux Vendor: Alessandro Vernassa http://www.flatnux.altervista.org/ Vulnerable Version: flatnux-2011-01.26 and probably prior versions Vendo...

Уязвимости в Drupal

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Full path disclosure и Insufficient Anti-automation уязвимостях в Drupal. Full path disclosure WASC-13: При POST запросе к странице с формой с использованием кириллического символа, выводится сообщение про ошибку, в котором выводится полный путь в...

HTB22832: Path disclosure in ArtGK CMS

Vulnerability ID: HTB22832 Reference: http://www.htbridge.ch/advisory/pathdisclosureinartgkcms.html Product: ArtGK CMS Vendor: ArtGK http://artgk-cms.ru/ Vulnerable Version: 2009-08-28 16:00:00 and Probably Prior Versions Vendor Notification: 01 February 2011 Vulnerability Type: Path disclosure...

HTB22821: Path disclosure in RunCMS

Vulnerability ID: HTB22821 Reference: http://www.htbridge.ch/advisory/pathdisclosureinruncms.html Product: RunCMS Vendor: http://www.runcms.org/ http://www.runcms.org/ Vulnerable Version: 2.2.2 Vendor Notification: 27 January 2011 Vulnerability Type: Path disclosure Risk level: Low Credit:...

Многочисленные уязвимости в Firebook

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Information Leakage, Brute Force и Cross-Site Scripting уязвимостях в Firebook. Information Leakage WASC-13: http://site/cgi-bin/firebook/firebook.cgi На странице есть раздел SystemInfo с Full path disclosure и именами txt-файлов БД веб приложения...

Уязвимости в Adobe ColdFusion

Здравствуйте 3APA3A! Сообщаю вам о найденных мною SQL DB Structure Extraction, Full path disclosure и Cross-Site Scripting уязвимостях в Adobe ColdFusion. Они имеют место на странице детального сообщения об ошибке. 16.11.2010 я приватно сообщил об этом Adobe, но они проигнорировали моё сообщение...

HTB22797: Path disclousure in BLOG:CMS

Vulnerability ID: HTB22797 Reference: http://www.htbridge.ch/advisory/pathdisclousureinblogcms.html Product: BLOG:CMS Vendor: Radek Hulan http://blogcms.com/ Vulnerable Version: 4.2.1.f and probably prior versions Vendor Notification: 13 January 2011 Vulnerability Type: Path disclousure Status: N...