Wildfly：WEB-INF和META-INF信息披露

No description provided by source...

[SECURITY] Fedora 24 Update: kernel-4.5.0-302.fc24

The kernel meta package...

Design/Logic Flaw

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly formerly JBoss Application Server before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the 1 WEB-INF or 2 META-INF directory via a request that contains a lowercase or b...

CVE-2016-0793

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly formerly JBoss Application Server before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the 1 WEB-INF or 2 META-INF directory via a request that contains a lowercase or b...

PT-2016-1632

Name of the Vulnerable Software and Affected Versions WildFly versions prior to 10.0.0.Final Description The issue is related to an incomplete blacklist vulnerability in the servlet filter restriction mechanism. This allows remote attackers to read sensitive files in the WEB-INF or META-INF...

Debian Security Advisory DSA 3538-1 (libebml - security update)

Several vulnerabilities were discovered in libebml, a library for manipulating Extensible Binary Meta Language files. CVE-2015-8789 Context-dependent attackers could trigger a use-after-free vulnerability by providing a maliciously crafted EBML document. CVE-2015-8790 Context-dependent attackers...

Snapchat: XSS found on Snapchat website

Hi Snapchat Team, I've found a reflected XSS vulnerability on this page: https://www.snapchat.com/add/snapchat Example: https://www.snapchat.com/add/%22%3E%3Ch1%3EXSS%3C%2Fh1%3E Note: you should visit the page with a mobile user-agent since the server displays different information based on the...

[SECURITY] Fedora 23 Update: kernel-4.4.6-300.fc23

The kernel meta package...

OpenSSH Implementations with X11Forwarding Enabled Should Heed Recent Security Update

Users who choose to enable X11Forwarding in OpenSSH, or those who use software products that re-enable it, should pay close attention to last Wednesday’s OpenSSH security update. The latest version of the open source implementation of the SSH protocol patches a flaw that exposes it to command...

OpenSSH Patches Information Leak Flaw

OpenSSH on Friday last Wednesday dropped a patch for a vulnerability that could expose files to theft and manipulation. The flaw affects all versions of OpenSSH prior to 7.2p2 with X11Forwarding enabled, the OpenSSH project said in its advisory. Unpatched versions of OpenSSH don’t properly saniti...

Vimeo: Private, embeddable videos leaks data through Facebook & Open Graph

Clip meta-data disclosed to thrid-party crawlers...

WordPress Plugin WP Advanced Comment 0.10 - Persistent Cross-Site Scripting

WordPress Plugin WP Advanced Comment 0.10 - Persistent Cross-Site Scripting 1. Introduction Exploit Title: WordPress WP Advanced Comment 0.10 Persistent XSS Date: Mar.09.2016 Exploit Author: Mohammad Khaleghi Contact: https://twitter.com/blackmatrix Vendor: Ravi Shakya Tested On: Apache2.2 / PHP5...

[SECURITY] Fedora 22 Update: kernel-4.4.3-201.fc22

The kernel meta package...

[SECURITY] Fedora 23 Update: kernel-4.4.3-300.fc23

The kernel meta package...

[SECURITY] Fedora 23 Update: kernel-4.4.2-301.fc23

The kernel meta package...

CVE-2015-5266

The CVE-2015-5266 entry concerns Moodle’s enrol_meta_sync in enrol/meta/locallib.php. Affected releases include Moodle 2.6.11 and 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2. The vulnerability arises from incorrect role processing during a long-running synchronization script, ...

CVE-2015-5266: Undefined Security Weakness

The enrolmetasync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incorrect role processing during a long-runni...

WordPress User Meta Manager 3.4.6 Information Disclosure

Exploit Title: WordPress User Meta Manager Plugin Information Disclosure Discovery Date: 2015-12-28 Public Disclosure Date: 2016-02-01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://jasonlau.biz/home/ Software Link:...

WordPress User Meta Manager Plugin 3.4.6 - Information Disclosure

Because of this vulnerability, any user, who is registered, can perform many AJAX requests and in that way get all contents of "usermeta" DB table. Solution Upgrade to version 3.4.8...

WordPress Plugin User Meta Manager 3.4.6 - Information Disclosure

WordPress Plugin User Meta Manager 3.4.6 - Information Disclosure Exploit Title: WordPress User Meta Manager Plugin Information Disclosure Discovery Date: 2015-12-28 Public Disclosure Date: 2016-02-01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage:...