OLX: Server Version Of https://www.olx.ph/

i see a server version of your website that have link: https://www.olx.ph/.htaccess The impact of this vulnerability Consult Web References for more information. This is a proof. http://prnt.sc/dtsjmo -- jaypogzz...

ByREV WP-PICShield - Cross-Site Request Forgery (CSRF)

The ByREV WP-PICShield WordPress plugin is vulnerable to CSRF. When updating the plugin options, several parameters in the issued POST request are written directly to the .htaccess file within the WordPress root directory. An attacker may be able to insert arbitrary lines into the .htaccess file,...

ByREV WP-PICShield - Cross-Site Request Forgery (CSRF)

The ByREV WP-PICShield WordPress plugin is vulnerable to CSRF. When updating the plugin options, several parameters in the issued POST request are written directly to the .htaccess file within the WordPress root directory. An attacker may be able to insert arbitrary lines into the .htaccess file,...

X (Formerly Twitter): Remote Unrestricted file Creation/Deletion and Possible RCE.

Hello Gents, During my research on Twitter BBP, I found below domain name: Reverb.twitter.com Background: We worked with Twitter to develop TwitterReverb, an application that reveals how conversations arise and reverberate across the entire Twitter landscape. The custom application allows visitor...

Pushwoosh: htaccess file is accesible

Design Issue, Information Disclosure, Low Severity. Non-critical , a little information disclosure...

My Little Forum 2.3.7 Cross Site Request Forgery / Cross Site Scripting

Title: ====== My Little Forum 2.3.7 - Multiple Vulnerability Product & Service Introduction: =============================== My little forum is a simple PHP and MySQL based internet forum that displays the messages in classical threaded view tree structure. It is Open Source licensed under the GN...

OLX: Directory Listing of all the resource files of olx.com.eg

By looking in the css of " olx.com.eg " i found that the logo src is linking to an external website https://olxegstatic-a.akamaihd.net/bd498cb-868/packed/img/2fc685b4081782d863b0c0c452ee54197b.png this was so normal until i simply changed the url to just https://olxegstatic-a.akamaihd.net/ I foun...

ownCloud: Accessable Htaccess

Hello Team , Request: if u think the reported issues have an Acceptable risk and u r not going to make changes then kindly request to mark as Informative . Reference:- 8061 , 7813 , 163106 POC URL:- https://demo.owncloud.org/.htaccess Regard's Santhosh...

Nextcloud: Information Disclosure of .htaccess file in Private Server/Subdomain

@ahsantahir reported a missing permission check on an internal service allowing the extraction of the .htaccess file. We've fixed this by adjusting the Apache configuration and putting Basic Auth in front of the page. On request of the reporter this is disclosed limitedly. Non-Critical, small...

FreePBX 1314 - Remote Command Execution Privilege Escalation

FreePBX 1314 - Remote Command Execution Privilege Escalation !/usr/bin/env python -- coding, latin-1 -- DESCRIPTION FreePBX 13 remote root 0day - Found and exploited by pgt @ nullsecurity.net AUTHOR pgt - nullsecurity.net DATE 8-12-2016 VERSION freepbx0day.py 0.1 AFFECTED VERSIONS FreePBX 13 & 14...

FreePBX 13/14 - Remote Command Execution / Privilege Escalation

!/usr/bin/env python -- coding, latin-1 -- DESCRIPTION FreePBX 13 remote root 0day - Found and exploited by pgt @ nullsecurity.net AUTHOR pgt - nullsecurity.net DATE 8-12-2016 VERSION freepbx0day.py 0.1 AFFECTED VERSIONS FreePBX 13 & 14 System Recordings Module versions: 13.0.1beta1 - 13.0.26...

FreePBX 13 / 14 - Remote Command Execution / Privilege Escalation

Exploit for linux platform in category remote exploits !/usr/bin/env python -- coding, latin-1 -- DESCRIPTION FreePBX 13 remote root 0day - Found and exploited by pgt @ nullsecurity.net AUTHOR pgt - nullsecurity.net DATE 8-12-2016 VERSION freepbx0day.py 0.1 AFFECTED VERSIONS FreePBX 13 & 14 Syste...

CodeIgniter: Web Server Disclosure

I would like to report an exposure of your web server kindly browse https://www.codeigniter.com/.htaccess...

The vulnerability of the server operating system OS X Server, which allows a perpetrator to obtain confidential configuration information

The vulnerability of the Web Server component in the OS X Server operating system arises from an improper restriction on access to the .DSStore and .htaccess files. Exploiting this vulnerability allows a malicious actor, operating remotely, to obtain confidential configuration information through...

CVE-2016-1776

Web Server in Apple OS X Server before 5.1 does not properly restrict access to .DSStore and .htaccess files, which allows remote attackers to obtain sensitive configuration information via an HTTP request...

Cross site request forgery (csrf)

Web Server in Apple OS X Server before 5.1 does not properly restrict access to .DSStore and .htaccess files, which allows remote attackers to obtain sensitive configuration information via an HTTP request...

CVE-2016-1776

CVE-2016-1776 affects Apple OS X Server before 5.1, in the Web Server component. The issue is an information disclosure where access to .DS_Store and .htaccess files is not properly restricted, allowing remote attackers to obtain sensitive configuration information via HTTP. Mitigation: upgrade t...

CVE-2016-1776

Web Server in Apple OS X Server before 5.1 does not properly restrict access to .DSStore and .htaccess files, which allows remote attackers to obtain sensitive configuration information via an HTTP request...

New Relic: https://rpm.newrelic.com/.htaccess file is world readable

Normally, only the web server is allowed to read the .htaccess file, but in this case, it appears that there is a misconfiguration that is causing the contents of the .htaccess located at https://rpm.newrelic.com/.htaccess to become world readable, as you can see from the information below and th...

Fedora 23 : roundcubemail-1.1.4-2.fc23 (2015-6e299214b8)

Release 1.1.4 - Add workaround for https://bugs.php.net/bug.php?id=70757 1490582 - Fix duplicate messages in list and wrong count after delete 1490572 - Fix so Installer requires PHP5 - Make brute-force attacks harder by re-generating security token on every failed login 1490549 - Slow down brute...