Western Digital TV Media Player Multiple critical vulnerabilities

Exploit for hardware platform in category web applications title: Multiple critical vulnerabilities product: Western Digital TV Media Player vulnerable version: 1.03.07 fixed version: - CVE number: - impact: Critical homepage: https://www.wdc.com found: 2017-01-17 by: Wan Ikram Office Kuala Lumpu...

CVE-2017-8899

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to moderator/admin accounts. The...

CVE-2017-8899

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to moderator/admin accounts. The...

Paragon Initiative Enterprises: Full Path Disclousure on https://airship.paragonie.com

Hi , i found an full path disclousure vulnerability on https://airship.paragonie.com For reproduce this vulnerability go to: https://airship.paragonie.com/my/cabins You will see something like this : Class '\ParagonIE\Airship\Cabins' not found 0 /var/www/paragonie/framework/Router.php236:...

Paragon Initiative Enterprises: Full Path Disclosure in airship.paragonie.com '/cabins/'

Hello Team, first am so sorry if i test this in your site, since i got problem to install in my own. So when i see your blog i got end point to https://airship.paragonie.com which is "Powered By Airship" or made using Airship CMS. step To Reproduce 1. register an account 2. navigate to...

Weblate: full path disclosure at hosted.weblate.org/admin/accounts/profile/

Browsing this link https://hosted.weblate.org/admin/accounts/profile/ will ask for admin username and password as asked when browsing https://hosted.weblate.org/admin/accounts/ or https://hosted.weblate.org/admin/ hence disclosing the directory path of forbidden area. screenshot : path.png also i...

Multiple vulnerabilities in Joomla jDBexport component

Joomla is the U.S. OpenSourceMatters team of a set of PHP and MySQL development using open source, cross-platform content management system CMS. Joomla jDBexport component has a cross-site scripting and path disclosure vulnerability, which can be exploited by an attacker to inject arbitrary Web...

SilverStripe CMS < 3.1.10 Information Disclosure Vulnerability - Active Check

SilverStripe CMS is prone to a path disclosure vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Joomla jDBexport 3.2.10 Cross Site Scripting / Path Disclosure

Exploit Title: Joomla Component jDBexport 3.2.10 - Cross-site scripting / Full Path Disclosure Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Mojtaba Kazemi Home : https://extensions.joomla.org/extensions/extension/core-enhancements/data-reports/jdbexport/ Home :...

Joomla! < 3.7.0 Multiple Vulnerabilities

According to its self-reported version number, the Joomla! installation running on the remote web server is prior to 3.7.0. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the JMail API due to PHPMail version information being included in mail headers. An...

Joomla jDBexport 3.2.10 Cross Site Scripting / Path Disclosure Vulnerabilities

Joomla jDBexport component version 3.2.10 suffers from cross site scripting and path disclosure vulnerabilities Exploit Title: Joomla Component jDBexport 3.2.10 - Cross-site scripting / Full Path Disclosure Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Mojtaba Kazemi Home :...

CVE-2017-8057

In Joomla! 3.4.0 through 3.6.5 fixed in 3.7.0, multiple files caused full path disclosures on systems with enabled error reporting...

CVE-2017-8057

In Joomla! 3.4.0 through 3.6.5 fixed in 3.7.0, multiple files caused full path disclosures on systems with enabled error reporting...

CVE-2017-8057

Joomla! versions 3.4.0–3.6.5 are affected by CVE-2017-8057, which causes full path disclosure via multiple files when error reporting is enabled; fixed in 3.7.0. Connected docs corroborate this CVE as part of a set of issues and describe installation-path disclosure under error-verbose circumstan...

Homebrew: [bot.brew.sh] Full Path Disclosure

Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page source, require the attacker to have the full path to the file they wis...

Spots.IM Comments <= 3.0.0 - Multiple Vulnerabilities

Various XSS issues and Full Path Disclosure...

LanternCMS Cross Site Scripting / SQL Injection

https://www.osisecurity.com.au/lantern-cms-path-disclosure-sql-injection-reflected-xss.html Date: 04-Apr-2017 Product: LanternCMS Versions affected: Unknown Vulnerabilities: 1 Path disclosure By requesting a site with an invalid intSiteI or numRedirectCount:...

SilverStripe CMS 3.1.9 Path Disclosure

https://www.osisecurity.com.au/silverstripe-cms---path-disclosure.html Date: 04-Apr-2017 Product: SilverStripe CMS Versions affected: 3.1.9 and below. Vulnerability: Path disclosure. Example URL: http://target/dev/build/ Path reported: /home/target/publichtml/framework/dev/DebugView.php...

Nextcloud: Reflected XSS in error pages (NC-SA-2017-008)

Hello, I found a HTML injection vulnerability 1 flaw in the Nextcloud and Owncloud latest version. Through this vulnerability an attacker could manipulate the website. This vulnerability could affect to the logged users. An attacker could send a malicious link that contains the manipulated URL to...

Rockstar Games: Full path Disclosure in Rockstargames.com██████████

Browsing this link http://www.rockstargames.com██████ gives forbidden error. Its good but also it displays the full path of the current directory . Refer screenshot attached...