4810 matches found
WordPress MP3 jPlayer Plugin <= 2.3.3 - Full Path Disclosure
Because of this vulnerability, attackers can disclose path information on wordpress sites. Solution Update the plugin...
MP3-jPlayer <= 2.4.2 - Full Path Disclosure
The download.php code allows arbitrary users to disclose path information on WordPress sites with this plugin installed. 120 $info = " 121 Get: " . $mp3 . " 122 Sent: " . $sent . " 123 File: " . $file . " 124 Open: " . $SERVER'DOCUMENTROOT' . $fp . " 125 Root: " . $rooturl . " 126 pID: "...
MP3-jPlayer <= 2.4.2 - Full Path Disclosure
The download.php code allows arbitrary users to disclose path information on WordPress sites with this plugin installed. 120 $info = " 121 Get: " . $mp3 . " 122 Sent: " . $sent . " 123 File: " . $file . " 124 Open: " . $SERVER'DOCUMENTROOT' . $fp . " 125 Root: " . $rooturl . " 126 pID: "...
WordPress MP3 jPlayer Plugin <= 2.3.3 - Full Path Disclosure
Because of this vulnerability, attackers can disclose path information on wordpress sites. Solution Update the plugin...
subversion -- multiple vulnerabilities
Subversion reports: CVE-2015-3184: Subversion's modauthzsvn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4. CVE-2015-3187: Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by...
Keybase: Full path disclosure at https://keybase.io/_/api/1.0/invitation_request.json
When we send a POST-request to https://keybase.io//api/1.0/invitationrequest.json with multiple fullname parameters, for example: [email protected]&fullname=1&fullname=2 we get an error response, which contains infromation about the server paths and code: TypeError: Object 1,2 has no method...
PT-2015-5530
Name of the Vulnerable Software and Affected Versions IBM InfoSphere Master Data Management Collaborative Edition versions 9.1 through 11.4 before FP03 Description The issue allows remote authenticated users to obtain sensitive information via a crafted request. This is achieved by revealing the...
Joomla! Component com_docman - Multiple Vulnerabilities
Joomla! Component comdocman - Multiple Vulnerabilities Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: [email protected] Date: 13/07/2015 Vendor Homepage:...
Joomla! Component com_docman - Multiple Vulnerabilities
Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: [email protected] Date: 13/07/2015 Vendor Homepage:...
Joomla Docman Path Disclosure / Local File Inclusion
Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: [email protected] Date: 13/07/2015 Vendor Homepage:...
Joomla Docman Path Disclosure / Local File Inclusion Vulnerabilities
Joomla Docman suffers from full path disclosure and local file inclusion vulnerabilities. Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: email protected Date:...
WordPress Vulcan Theme XSS / Disclosure/ DoS
Hello list! Let's back to vulnerabilities, which I disclosed in April 2011, which can be used for DDoS attacks on other sites, e.g. with my DAVOSET http://seclists.org/fulldisclosure/2015/Jun/111. In addition to hundreds of themes, which I wrote about in previous years, here is another theme for...
Multiple vulnerabilities in Vulcan theme for WordPress + WAF bypass
Hello 3APA3A! Let's back to vulnerabilities, which I disclosed in April 2011, which can be used for DDoS attacks on other sites, e.g. with my DAVOSET http://seclists.org/fulldisclosure/2015/Jun/111. In addition to hundreds of themes, which I wrote about in previous years, here is another theme fo...
SysAid Path Disclosure Vulnerability
SysAid Help Desktop Software is prone to a path disclosure vulnerability Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...
SysAid Help Desk 14.4 - Multiple Vulnerabilities
SysAid Help Desk 14.4 - Multiple Vulnerabilities Multiple vulnerabilities in SysAid Help Desk 14.4 Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Disclosure: 03/06/2015 / Last updated:...
Shopify: Header Misconfiguration - PHP API
Hey, Your index api page auth can easily be bypassed because it doesn't use proper auth practices in its PHP core. Here is the master code from Shopify: https://github.com/Shopify/shopifyphpapi/blob/master/index.php it says: if !isset$SESSION'shop' || !isset$SESSION'token' header"Location:...
WordPress SpamFree Plugin <= 1.9.2 - Full Path Disclosure
This plugin is prone to a multiple script direct request path disclosure. Solution Upgrade the plugin...
WordPress Random Image Widget Plugin - Full Path Disclosure
This plugin is prone to a full path disclosure vulnerability. Solution Update plugin...
WordPress RokNewsPager Plugin <= 1.17 - Multiple Vulnerabilities
This plugin is prone to cross site scripting, denial of service, full path disclosure and arbitrary file upload vulnerabilities. Solution Update plugin...