XSS and FPD vulnerabilities in Js-Multi-Hotel for WordPress

Hello 3APA3A! These are vulnerabilities in Js-Multi-Hotel plugin for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are Js-Multi-Hotel 2.2.1 and previous versions. ------------------------- Affected vendors: ------------------------- Joomlaskin...

Vulnerabilities in Js-Multi-Hotel for WordPress

Hello 3APA3A! These are vulnerabilities in Js-Multi-Hotel plugin for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are Js-Multi-Hotel 2.2.1 and previous versions. ------------------------- Affected vendors: ------------------------- Joomlaskin...

CVE-2013-7060

Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified documentation which is initialized in class scope...

Localize: Full Path Disclosure (FPD) in www.localize.im

Hi, found another information disclosure vulnerability/Full Path Disclosure on your application. Proof of Concept ------------------------- GET : https://www.localize.im/projects/projiect ID/languages/Language ID POST CONTENT:...

Localize: Full Path Disclosure (FPD) in www.localize.im

Hi, I found an information disclosure vulnerability/Full Path Disclosure on your application. Proof of Concept ------------------------- GET : https://www.localize.im/projects/projiect ID/languages/Language ID POST CONTENT:...

Respondly: Full Path Disclosure

"code":500,"error":"Failed to render CSS stylesheet.","file":"/assets/packages/app/shared/css/","message":"ENOENT, open '/srv/www/respondly/releases/20140421220734/marketingbundle/programs/server/assets/packages/app/shared/css/" Request ------------ GET /css/shared/%22ns=%22alert9 HTTP/1.1...

StopTheHacker: Information Disclosure (FPD) - stopthehacker.com

Hi, I found a information disclosure vulnerabilityFull path disclosure Vulnerable link : http://www.stopthehacker.com/wp-includes/rss-functions.php You can see in the page the path of the site Fatal error: Call to undefined function deprecatedfile in...

Localize: Full Path Disclosure / Info Disclosure in Importing XML Section!

Hello, I found another information disclosure vulnerability/Full Path Disclosure on your application. now its on Import XML Section Proof of Concept ------------------------- POST : http://www.localize.io/import/ project ID POST CONTENT: -----------------------------97823247315770\r\n...

Localize: Full Path Disclosure / Info Disclosure in Creating New Group

Hi, I found another information disclosure vulnerability/Full Path Disclosure on your application. this time its on Creating New Group Section. Proof of Concept ------------------------- GET : http://www.localize.io/pages/createproject/ project ID POST CONTENT: CSRFToken=TOKEN...

Localize: Full Path Disclosure (FPD) in www.localize.io

Hi, I found an information disclosure vulnerability/Full Path Disclosure on your application. Proof of Concept ------------------------- GET : http://www.localize.io/pages/createproject/ project ID POST CONTENT: CSRFToken=TOKEN...

Localize: Full Path Disclosure

Not my best piece of work, but the following file results in a full path disclosure if reviewphraseobject is given the wrong parameter. http://www.localize.io/review/3C/languages/5 POST...

Localize: Path Disclosure (Info Disclosure) in http://www.localize.io

Hello, I found a information disclosure vulnerability. How to reproduce: GET : http://www.localize.io/ POST : signinusername=test&signinpassword=test The info from page is Warning: trim expects parameter 1 to be string, array given in...

Localize: Full path disclosure

I signed up for localize with [email protected], and localize sent me a verification link which was: http://www.localize.io/verify/e6be646b24pdd3w6d5c27ppa9a267ee7 When I visited that link I found it was showing the following error: Fatal error: Call to a member function...

Concrete CMS: FULL PATH DISCLOSUR

Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page source, require the attacker to have the full path to the file they wis...

JoomShopping 4.4.2 - Multiple XSS & FPD Vulnerabilities

Joomla extension called JoomShopping suffers on multiple Cross Site Scripting and Full Path Disclosure vulnerabilities because of poor POST & GET parameter filtration. Title: JoomShopping - Multiple XSS & FPD Date: 13.04.14 Vendor: joomshopping.com Demo: demo.joomshopping.com Dork:...

Khan Academy: Full Path Disclosure on [smarthistory.khanacademy.org]

Hello, I have found a full path disclosure on a website that runs a wordpress installation. There isn't much to explain about this bug, as it's pretty self explanatory. What an attack can do with this bug is identify the full path, and the user the site is running under. If the attacker finds a...

WordPress Js-Multi-Hotel 2.2.1 XSS / DoS / Disclosure / Abuse

Hello list! There are multiple vulnerabilities in Js-Multi-Hotel plugin for WordPress. Earlier I wrote about two other vulnerabilities. These are Abuse of Functionality, Denial of Service, Cross-Site Scripting and Full path disclosure vulnerabilities in Js-Multi-Hotel plugin for WordPress. There...

Concrete CMS: CONCRETE5 - path disclosure.

Hi, When you emtpy the cookie CONCRETE5 it will throw the following error on the page : Warning: sessionstart function.session-start: The session id contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in /home/c5host/msmversions/012312/concrete/startup/session.php on line 22...

phpMyAdmin 3.5.x < 3.5.8.2 / 4.0.x < 4.0.4.2 Multiple Vulnerabilities

Binary data 8144.prm...

Joomla-Base XSS / XML Injection / Denial Of Service

Hello list! These are Denial of Service, XML Injection, Cross-Site Scripting, Full path disclosure and Insufficient Anti-automation vulnerabilities in Joomla-Base. This is package of Joomla with different plugins with their vulnerabilities. These vulnerabilities are in Google Maps plugin for...