Multiple Web Applications | Full Path Disclosure

The following web applications are found to have full path disclosure flaws Ref: WASC-13, CWE-200. ----------------------------------------- htmlpurifier-4.2.0 phpids-0.6.5 PhpSecInfo 111WebCalendar-1.2.3 adodb aef-1.0.8 ATutor-2.0 auth b2evolution-3.3.3 bbpress-1.0.2 cftp-r80 claroline-1.9.7...

Adobe ColdFusion Cross Site Scripting / Disclosure

Hello list! I want to warn you about SQL DB Structure Extraction, Full path disclosure and Cross-Site Scripting vulnerabilities in Adobe ColdFusion. The vulnerabilities exist at detailed error report page. At 16.11.2010 I privately informed Adobe about it, but they ignored my letter...

Hycus CMS 1.0.3 Path Disclosure

Vulnerability ID: HTB22795 Reference: http://www.htbridge.ch/advisory/pathdisclousureinhycuscms.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 and probably prior versions Vendor Notification: 13 January 2011 Vulnerability Type: Path...

Full path disclosure и SQL Injection уязвимости в MC Content Manager

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Full path disclosure и SQL Injection уязвимостях в системе MC Content Manager. Это украинская коммерческая CMS. Full path disclosure WASC-13: http://site/article.php?root=a SQL Injection WASC-19: http://site/article.php?root=-120and20version=4...

xAjax Cross Site Scripting / Path Disclosure

Hello list! I want to warn you about Cross-Site Scripting and Full path disclosure vulnerabilities in xAjax and xajaxjqueryplugin. ------------------------- Affected products: ------------------------- Vulnerable are potentially all versions of xAjax. Vulnerable are all versions of...

Уязвимости в xAjax и xajax_jquery_plugin

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting и Full path disclosure уязвимостях в xAjax и xajaxjqueryplugin. XSS WASC-08: http://site/cms/’;alertdocument.cookie;/ Это DOM Based XSS. Данная уязвимость в частности имеет место в MC Content Manager которая использует xAjax...

Vulnerabilities in MC Content Manager

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Cross-Site Scripting, Brute Force и Full path disclosure уязвимостях в MC Content Manager. Это украинская коммерческая CMS. XSS WASC-08: http://site/cms/’;alertdocument.cookie;/ Brute Force WASC-11: http://site/admin/ Full path disclosure WASC-13:...

MC Content Manager 10.1.1 Cross Site Scripting / Path Disclosure

Hello list! I want to warn you about Cross-Site Scripting, Brute Force and Full path disclosure vulnerabilities in MC Content Manager. It's Ukrainian commercial CMS. ------------------------- Affected products: ------------------------- Vulnerable are potentially all versions of MC Content Manage...

phpMySport 1.4 - SQL Injection / Authentication Bypass / Full Path Disclosure

Vulnerability ID: HTB22770 Reference: http://www.htbridge.ch/advisory/sqlinjectioninphpmysport.html Product: phpMySport Vendor: phpMySport http://phpmysport.sourceforge.net/ Vulnerable Version: 1.4 Vendor Notification: 21 December 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendor...

phpMySport 1.4 - SQL Injection Authentication Bypass Full Path Disclosure

phpMySport 1.4 - SQL Injection Authentication Bypass Full Path Disclosure Vulnerability ID: HTB22770 Reference: http://www.htbridge.ch/advisory/sqlinjectioninphpmysport.html Product: phpMySport Vendor: phpMySport http://phpmysport.sourceforge.net/ Vulnerable Version: 1.4 Vendor Notification: 21...

html-edit CMS - Multiple Vulnerabilities

html-edit CMS - Multiple Vulnerabilities Vulnerability ID: HTB22734 Reference: http://www.htbridge.ch/advisory/sqlinjectioninhtmleditcms.html Product: HTML-EDIT CMS Vendor: html-edit web services http://www.html-edit.org/ Vulnerable Version: 3.1.8 Vendor Notification: 02 December 2010 Vulnerabili...

Vulnerabilities in Register Plus Redux for WordPress

Hello Bugtraq! I want to warn you about Cross-Site Scripting, Insufficient Anti-automation and Full path disclosure vulnerabilities in plugin Register Plus Redux for WordPress. Register Plus Redux is a fork of plugin Register Plus. ------------------------- Affected products:...

Уязвимости в Register Plus Redux для WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, Insufficient Anti-automation и Full path disclosure уязвимостях в плагине Register Plus Redux для WordPress. Register Plus Redux - это разветвление fork плагина Register Plus. XSS WASC-08: POST запрос на странице...

Etomite 1.1 Multiple Vulnerabilities

Exploit for php platform in category web applications ==================================== Etomite 1.1 Multiple Vulnerabilities ==================================== Product: Etomite Vendor: http://www.etomite.org/ http://www.etomite.org/ Vulnerable Version: 1.1 Vendor Notification: 18 November 20...

etomite 1.1 - Multiple Vulnerabilities

etomite 1.1 - Multiple Vulnerabilities Vulnerability ID: HTB22710 Reference: http://www.htbridge.ch/advisory/sqlinjectioninetomite.html Product: Etomite Vendor: http://www.etomite.org/ http://www.etomite.org/ Vulnerable Version: 1.1 Vendor Notification: 18 November 2010 Vulnerability Type: SQL...

etomite 1.1 - Multiple Vulnerabilities

Vulnerability ID: HTB22710 Reference: http://www.htbridge.ch/advisory/sqlinjectioninetomite.html Product: Etomite Vendor: http://www.etomite.org/ http://www.etomite.org/ Vulnerable Version: 1.1 Vendor Notification: 18 November 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendor...

Path disclosure in Enano CMS

Vulnerability ID: HTB22708 Reference: http://www.htbridge.ch/advisory/pathdisclosureinenanocms.html Product: Enano CMS Vendor: enanocms.org http://enanocms.org/ Vulnerable Version: 1.1.7pl1 Vendor Notification: 16 November 2010 Vulnerability Type: Path disclosure Status: Fixed by Vendor Risk leve...

Vulnerabilities in Register Plus for WordPress

Hello Bugtraq! I want to warn you about Cross-Site Scripting, Insufficient Anti-automation and Full path disclosure vulnerabilities in plugin Register Plus for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are versions of plugin Register Plus 3.5.1 a...

Register Plus <= 3.5.1 - Full Path Disclosure

It is unclear whether or not the issue has been fixed. Plugin has been closed...

S-CMS 2.5 Multiple Vulnerabilities

Exploit for php platform in category web applications ================================== S-CMS 2.5 Multiple Vulnerabilities ================================== ============================================================ Exploit Title: S-CMS Multiple Vuln Date: 14/11/2010 Author: LordTittiS...