4796 matches found
WordPress Colormix Theme - Multiple Security Vulnerablities
WordPress Colormix theme is prone to multiple security vulnerabilities such as cross-site scripting, path disclosure and multiple content-spoofing vulnerabilities. Solution Update the theme...
WordPress Colormix theme XSS / Full path disclosure Vulnerability
Exploit for php platform in category web applications Last year I've disclosed vulnerabilities in JW Player and in RokBox. Which were fixed by the developers - JW Player developers fixed one hole and promised to fix others later and RokBox fixed all holes but it was questionable how they fixed...
WordPress Colormix XSS / Content Spoofing / Path Disclosure
Hello list! Last year I've disclosed vulnerabilities in JW Player and in RokBox. Which were fixed by the developers - JW Player developers fixed one hole and promised to fix others later and RokBox fixed all holes but it was questionable how they fixed holes related to JW Player. In December I've...
Mandriva Linux Security Advisory : dokuwiki (MDVSA-2013:073)
Updated dokuwiki package fixes security vulnerabilities : DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/tpl/index.php and certain other files...
SAP Portal WebDynPro - Path disclosure
Application: SAP NetWeaver JAVA Versions Affected: SAP NetWeaver J2EE Vendor URL: http://www.sap.com Bugs: Information Disclosure Exploits: YES Reported: 20.04.2013 Vendor response: 21.04.2013 Date of Public Advisory: 25.01.2014 Reference: SAP Security Note 1852146 CVSS: AV:N/AC:L/AU:N/C:P/I:N/A:...
Crafty Syntax Live Help RFI / Path Disclosure
Exploit Title : Crafty Syntax Live Help = 2.. & 3.. RFI + Path Disclosure Date : 4/19/2013 Author : ITTIHACK Home : http://ittihack.com Vendor : http://www.craftysyntax.com Download : http://www.craftysyntax.com/craftysyntax3.4.1.zip Version : 2. and 3. , All versions Category : webapps Google do...
Crafty Syntax Live Help 3.1.2 - Remote File Inclusion Full Path Disclosure
Crafty Syntax Live Help 3.1.2 - Remote File Inclusion Full Path Disclosure source: https://www.securityfocus.com/bid/59322/info Crafty Syntax Live Help is prone to a remote file-include vulnerability and a path-disclosure vulnerability because it fails to sufficiently sanitize user-supplied input...
Crafty Syntax Live Help 3.1.2 - Remote File Inclusion / Full Path Disclosure
source: https://www.securityfocus.com/bid/59322/info Crafty Syntax Live Help is prone to a remote file-include vulnerability and a path-disclosure vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting these issues could allow an attacker to obtain sensitive...
ZeroClipbord.swf Cross Site Scripting / Path Disclosure
Hello list! These are Cross-Site Scripting and Full path disclosure vulnerabilities in multiple themes for WordPress with ZeroClipboard.swf. Earlier I've wrote about Cross-Site Scripting vulnerabilities in ZeroClipboard http://seclists.org/fulldisclosure/2013/Feb/103. I wrote that this is very...
TinyWebGallery 1.8.9 Path Disclosure
============================================= INTERNET SECURITY AUDITORS ALERT 2013-012 - Original release date: March 19th, 2013 - Last revised: April 6th, 2013 - Discovered by: Manuel Garcia Cardenas - Severity: 5/10 CVSS Base Score - CVE-ID: CVE-2013-2631...
CKEditor sample_posteddata.php XSS
The version of the CKEditor installed on the remote host is affected by a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input to the 'sampleposteddata.php' script. An unauthenticated, remote attacker may be able to leverage this to inject arbitrary HTML an...
NConf delete_attr.php id Parameter SQL Injection
The version of the NConf installed on the remote host is affected by a SQL injection vulnerability because it fails to properly sanitize user-supplied input to the 'id' parameter of the 'deleteattr.php' script. An attacker may be able to leverage this to manipulate data in the back-end database o...
Discuz! X2.5 api.php 路径泄露
No description provided by source...
PrestaShop Full Path Disclosure Vulnerability
Title: PrestaShop Full Path Disclosure Date: 16.03.2013 Tested on: FreeBSD 6.2 Version: All Dork: intext:"Powered by PrestaShop" Contact: email protected Full Path Disclosure: /footer.php /header.php /pagination.php /product-sort.php /modules/hipay/mapi/mapitax.php /init.php...
Drupal LiteCommerce (v.lc3-1.1.3) <= Multiple Vulnerabilities
Drupal LiteCommerce v.lc3 1.1.3 == Bug's : - Full Path Disclosure - XSS/HTML Injection XSRF - File/shell Upload This is private exploit. You can buy it at https://0day.today...
WordPress Counter Per Day 3.2.3 Path Disclosure
Exploit Title: WordPress Counter per Day plugin PATH DISCLOSURE once the previous request is performed, admin is unable to save notes anymore, nor view the previously saved ones. --------------------- HTTP request: 2 -- GET /wp-content/plugins/count-per-day/notes.php --------------------- HTTP...
WordPress Caulk Path Disclosure
Title: Caulk Wordpress Theme Full Path Disclosure Description: According to OWASP: Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to...
CKEditor 4.0.1 多个安全漏洞
CKEditor是一款在线文字编辑器 CKEditor存在多个安全漏洞，允许攻击者利用漏洞进行跨站请求伪造，跨站脚本攻击及获取路径信息 0 CKEditor 4.0.1 厂商解决方案 目前没有详细解决方案提供： http://ckeditor.com/ =========================================== Vulnerable Software: ckeditor 4.0.1 standard Download:...
CKEditor 4.0.1 - Multiple Vulnerabilities
CKEditor 4.0.1 - Multiple Vulnerabilities =========================================== Vulnerable Software: ckeditor 4.0.1 standard Download: http://download.cksource.com/CKEditor/CKEditor/CKEditor%204.0.1/ckeditor4.0.1standard.zip Vulns: Full Path Disclosure && XSS...