Ubuntu: Security Advisory (USN-2917-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Uber: Full path disclosure on track.uber.com

The page at track.uber.com had verbose stack traces enabled, allowing an attacker to learn information about the libraries, technologies and system information used in Uber Rush. Thanks, @firs0v!...

WordPress Plugin HB Audio Gallery Lite 1.0.0 - Arbitrary File Download

WordPress Plugin HB Audio Gallery Lite 1.0.0 - Arbitrary File Download Exploit Title: Wordpress Plugin HB Audio Gallery Lite - Arbitrary File Download Exploit Author: CrashBandicot Date: 2016-03-22 Google Dork : inurl:/wp-content/plugins/hb-audio-gallery-lite Vendor Homepage:...

cmseasy 5.6 index.php 网站路径泄露漏洞

No description provided by source...

Multiple vulnerabilities in extension phpMyAdmin (phpmyadmin)

It has been discovered that the extension "phpMyAdmin" phpmyadmin is susceptible to unsafe comparison of XSRF/CSRF token, multiple full path disclosure vulnerabilities, multiple XSS vulnerabilities, insecure password generation in JavaScript. Release Date: March 10, 2016 Component Type: Third par...

Fedora 23 : phpMyAdmin-4.5.3.1-1.fc23 (2015-deb2bbdde0)

phpMyAdmin 4.5.3.1 2015-12-25 =============================== - Undefined offset 2 - Security Path disclosure, see PMASA-2015-6 ---- phpMyAdmin 4.5.3.0 2015-12-23 =============================== - Incomplete results of UNION ALL - MATCH AGAINST keywords not recognized - syntax verifier is not...

Fedora 23 : phpMyAdmin-4.5.4.1-1.fc23 (2016-e55278763e)

phpMyAdmin 4.5.4.1 2016-01-28 =============================== - Error with PMA 4.4.15.3 - Remove hard dependency on phpseclib phpMyAdmin 4.5.4 2016-01-28 ============================= - live data edit of big sets is not working - Table list not saved in db QBE bookmarked search - While 'changing ...

Fedora 22 : phpMyAdmin-4.5.4-1.fc22 (2016-e1fe01e96e)

phpMyAdmin 4.5.4 2016-01-28 ============================= - live data edit of big sets is not working - Table list not saved in db QBE bookmarked search - While 'changing a column', query fails with a syntax error after the 'CHARSET=' keyword - Avoid syntax error in JavaScript messages on invalid...

Fedora 22 : phpMyAdmin-4.5.3.1-1.fc22 (2015-345966871c)

phpMyAdmin 4.5.3.1 2015-12-25 =============================== - Undefined offset 2 - Security Path disclosure, see PMASA-2015-6 ---- phpMyAdmin 4.5.3.0 2015-12-23 =============================== - Incomplete results of UNION ALL - MATCH AGAINST keywords not recognized - syntax verifier is not...

ownCloud 8.0.x < 8.0.9, 8.1.x < 8.1.4 Path Disclosure Vulnerability - Windows

ownCloud is prone to path disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

ownCloud 8.0.x < 8.0.9, 8.1.x < 8.1.4 Path Disclosure Vulnerability - Linux

ownCloud is prone to path disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

Paragon Initiative Enterprises: Full Path Disclosure In EasyDB

Hi, as reported in 115337 about a full path disclosure in EasyDB you fixed some of them in last commits but single function is vulnerable too and not fixed yet! ifcount$params != count$params,COUNTRECURSIVE throw new \InvalidArgumentException"Invalid params"; this will check $params to be 1d arra...

DEBIAN-CVE-2016-2042

phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to 1 libraries/phpseclib/Crypt/AES.php or 2 libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message...

UBUNTU-CVE-2016-2044

libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message...

UBUNTU-CVE-2016-2038

phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message...

UBUNTU-CVE-2016-2042

phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to 1 libraries/phpseclib/Crypt/AES.php or 2 libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message...

CVE-2016-2038

phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message...

CVE-2016-2038

phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message...

CVE-2016-2038: Exposure of Sensitive Information to an Unauthorized Actor

phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message...

PT-2017-7491 · Send +1 · Send +1

Name of the Vulnerable Software and Affected Versions: send versions prior to 0.11.1 Description: The issue allows attackers to obtain the root path via unspecified vectors, potentially enabling them to enumerate paths on the server filesystem. Recommendations: For versions prior to 0.11.1, updat...