ownCloud: Full Path Disclosure

When I was trying to upload a html file as profile picture as a non admin user. then it popped up with a message containing full path . Like that "Could not obtain lock type 1 on "/opt/lampp/htdocs/owncloud/data/12/files/opt/lampp/htdocs/owncloud/data/12/cache/avatarupload"." Thanks...

ownCloud: Full Path Disclosure

When I was trying to load a file which is not actually exist then it shows "message":"Could not obtain lock type 1 on "/opt/lampp/htdocs/owncloud/data/admin/files/lol"." Request GET /owncloud/index.php/apps/filestexteditor/ajax/loadfile?filename=lol HTTP/1.1 Host: 192.168.0.105...

ownCloud: apps.owncloud.com: Path Disclosure

Threat: A potentially sensitive file, directory, or directory listing was discovered on the Web server. Impact: The contents of this file or directory may disclose sensitive information. Solution: Verify that access to this file or directory is permitted. If necessary, remove it or apply access...

Debian DLA-293-1 : subversion security update

C. Michael Pilato, from CollabNet, reported an issue in the version control system Subversion. CVE-2015-3187 Subversion servers revealed some sensible paths hidden by path-based authorization. Remote authenticated users were allowed to obtain path information by reading the history of a node that...

JVN#20459920: Microsoft Office discloses a file path of a local file

When a file such as a clipart or an image is inserted in Office documents, the absolute path of the local file is stored in "alternative text". Impact An attacker may obtain information about the file system or the user name through Office documents. Solution Upgrade the Software Upgrade to the...

WordPress MP3-jPlayer 2.3.2 Path Disclosure Vulnerability

WordPress MP3-jPlayer plugin version 2.3.2 suffers from a path disclosure vulnerability. Title: Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-12 Download Site: https://wordpress.org/plugins/mp3-jplayer/ Vendor:...

WordPress MP3 jPlayer Plugin <= 2.3.3 - Full Path Disclosure

Because of this vulnerability, attackers can disclose path information on wordpress sites. Solution Update the plugin...

MP3-jPlayer <= 2.4.2 - Full Path Disclosure

The download.php code allows arbitrary users to disclose path information on WordPress sites with this plugin installed. 120 $info = " 121 Get: " . $mp3 . " 122 Sent: " . $sent . " 123 File: " . $file . " 124 Open: " . $SERVER'DOCUMENTROOT' . $fp . " 125 Root: " . $rooturl . " 126 pID: "...

MP3-jPlayer <= 2.4.2 - Full Path Disclosure

The download.php code allows arbitrary users to disclose path information on WordPress sites with this plugin installed. 120 $info = " 121 Get: " . $mp3 . " 122 Sent: " . $sent . " 123 File: " . $file . " 124 Open: " . $SERVER'DOCUMENTROOT' . $fp . " 125 Root: " . $rooturl . " 126 pID: "...

WordPress MP3 jPlayer Plugin <= 2.3.3 - Full Path Disclosure

Because of this vulnerability, attackers can disclose path information on wordpress sites. Solution Update the plugin...

WordPress MP3-jPlayer 2.3.2 Path Disclosure

Title: Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-12 Download Site: https://wordpress.org/plugins/mp3-jplayer/ Vendor: https://profiles.wordpress.org/simonward-1/ Vendor Notified: 2015-08-06 Vendor Contact: Description:...

subversion -- multiple vulnerabilities

Subversion reports: CVE-2015-3184: Subversion's modauthzsvn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4. CVE-2015-3187: Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by...

Keybase: Full path disclosure at https://keybase.io/_/api/1.0/invitation_request.json

When we send a POST-request to https://keybase.io//api/1.0/invitationrequest.json with multiple fullname parameters, for example: [email protected]&fullname=1&fullname=2 we get an error response, which contains infromation about the server paths and code: TypeError: Object 1,2 has no method...

Joomla! Component com_docman - Multiple Vulnerabilities

Joomla! Component comdocman - Multiple Vulnerabilities Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: [email protected] Date: 13/07/2015 Vendor Homepage:...

Joomla! Component com_docman - Multiple Vulnerabilities

Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: [email protected] Date: 13/07/2015 Vendor Homepage:...

Joomla Docman Path Disclosure / Local File Inclusion

Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: [email protected] Date: 13/07/2015 Vendor Homepage:...

Joomla Docman Path Disclosure / Local File Inclusion Vulnerabilities

Joomla Docman suffers from full path disclosure and local file inclusion vulnerabilities. Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: email protected Date:...

WordPress Vulcan Theme XSS / Disclosure/ DoS

Hello list! Let's back to vulnerabilities, which I disclosed in April 2011, which can be used for DDoS attacks on other sites, e.g. with my DAVOSET http://seclists.org/fulldisclosure/2015/Jun/111. In addition to hundreds of themes, which I wrote about in previous years, here is another theme for...

Multiple vulnerabilities in Vulcan theme for WordPress + WAF bypass

Hello 3APA3A! Let's back to vulnerabilities, which I disclosed in April 2011, which can be used for DDoS attacks on other sites, e.g. with my DAVOSET http://seclists.org/fulldisclosure/2015/Jun/111. In addition to hundreds of themes, which I wrote about in previous years, here is another theme fo...

SysAid Path Disclosure Vulnerability

SysAid Help Desktop Software is prone to a path disclosure vulnerability Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...