WordPress Starbox Voting Plugin - Full Path Disclosure

Because of this vulnerability, remote users can determine the full path to the web root directory and other potentially sensitive information. Solution Update the plugin...

WordPress Photocrati Theme - Full Path Disclosure

Because of this vulnerability, the attackers can obtain sensitive information via an invalid upload request. Solution Update the theme...

WordPress Appius Theme - Full Path Disclosure

Because of this vulnerability, the attackers can obtain sensitive information via an invalid upload request. Solution Update the theme...

WordPress Caulk Theme - Full Path Disclosure

Because of this vulnerability, the attackers can obtain sensitive information via an invalid upload request. Solution Update the theme...

WordPress Shotzz Theme - Full Path Disclosure

Because of this vulnerability, the attackers can obtain sensitive information via an invalid upload request. Solution Update the theme...

WordPress Dewplayer Plugin <= 1.2 - Full Path Disclosure

This plugin is prone to a direct rquest path disclosure weakness in dewplayer.php. Solution Update the plugin...

WordPress Sahifa Theme <= 2.4.0 - Multiple Vulnerabilities

This theme is prone to a cross site request forgery and full path disclosure vulnerabilities. Because of CSRF you can lost your site settings. Because of full path disclosure, the attackers can obtain sensitive information via an invalid upload request. Solution Update the theme...

WordPress Dewplayer Plugin <= 1.2 - Full Path Disclosure

This plugin is prone to a direct rquest path disclosure weakness in dewplayer.php. Solution Update the plugin...

CVE-2014-5107

concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to 1 system/basics/editor.php, 2 system/view.php, 3 system/environment/filestoragelocations.php, 4 system/mail/importers.php, 5 system/mail/method.php, 6 system/permissions/filetypes.php, 7...

CVE-2014-5107

Summary: CVE-2014-5107 affects concrete5 prior to 5.6.3. The vulnerability allows remote attackers to obtain the installation path via direct requests to a list of dashboard/ system pages (e.g., system/basics/editor.php, system/view.php, scrapbook/view.php, etc.). The issue is described consisten...

Mail.ru: e.mail.ru: File upload "Chapito" circus

Начинаем пихать зиробайты в имя файла на загрузке и поведение сервера неадекватно. Пока ничего страшнее чем local path disclosure, но боюсь импакт больше чем кажется. В имени файла в примере "������t123123", в хексе "220000000000007431323331323322" POST...

WordPress DZS Video Gallery XSS / Path Disclosure / Command Execution

Hello list! These are Cross-Site Scripting, Full path disclosure and OS Commanding vulnerabilities in plugin DZS Video Gallery for WordPress. Earlier I've disclosed Content Spoofing and Cross-Site Scripting vulnerabilities in this plugin http://securityvulns.ru/docs30871.html...

Localize: PHP PDOException and Full Path Disclosure

hi phrasekey , agian! in phraseChange action if set to array pdo quote show error! line 755 index.php Warning: PDO::quote expects parameter 1 to be string, array given in /srv/data/web/vhosts/www.localize.im/htdocs/classes/Database.php on line 30 Fatal error: Uncaught exception 'PDOException' wit...

Symbiose Webos Cross Site Scripting / Path Disclosure

Exploit Title: Symbiose Webos - XSS / FPD Date: 04 July 2014 Exploit Author: G4eL Download: http://symbiose.fr.cr/ Demo: http://webos.symbiose.fr.cr/ Tested on: Ubuntu http://domain/usr/?path=/usr/&type=1alert123 Results : Fatal error: Class 'lib\ctrl\rawDataCall\1alert123Controller' not found in...

RakhiSoftware Shopping Cart PHPSESSID Cookie Manipulation Path Disclosure

No description provided by source. source: http://www.securityfocus.com/bid/32563/info RakhiSoftware Shopping Cart is prone to multiple remote vulnerabilities. Exploiting these issues can allow attackers to obtain sensitive information, steal cookie data, access or modify data, or exploit latent...

AWStats <= 6.4 'awstats.pl' Multiple Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/34159/info AWStats is prone to a path-disclosure vulnerability. Exploiting this issue can allow an attacker to access sensitive data that may be used to launch further attacks against a vulnerable computer. The following...

DS3 Authentication Server - Multiple Vulnerabilities

No description provided by source. Original: http://www.digitalsec.net/stuff/explt+advs/DS3.AuthServer.txt =============================== - Advisory - =============================== Tittle: DS3 Authentication Server - Command Execution Post Authentication & other minor issues Risk: High Date:...

TikiWiki Project 1.8 tiki-view_chart.php chartId Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/10100/info Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting,...

phpplanner <= PHP Planner 0.4 - Multiple Vulnerabilities

No description provided by source. Title: phpplanner = PHP Planner v.0.4 Multiple Vulnerabilities Date: 13/05/10 Author: cp77fk4r | empty0pageSHIFT+2gmail.com | www.DigitalWhisper.co.il Software Link: http://phpplanner.sourceforge.net/ Version: = v.0.4 Tested on: PHP Full Path Disclosure Full Pat...

Flatnuke3 File Manager Module Unauthorized Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/26155/info Flatnuke3 is prone to an unauthorized-access vulnerability because it fails to adequately verify administrative credentials while logging in via the 'File Manager' module. An attacker can exploit this...