[SCSA-010] Path Disclosure & Cross Site Scripting Vulnerability in MyABraCaDaWeb

Security Corporation Security Advisory SCSA-010 PROGRAM: MyABraCaDaWeb HOMEPAGE: http://www.webmaster-mag.net/ VULNERABLE VERSIONS: v1.0.2 and prior DESCRIPTION MyABraCaDaWeb is an other Content Management Systems like PHP-Nuke More informations at :...

CVE-2002-1454: Undefined Security Weakness

MyWebServer 1.0.2 allows remote attackers to determine the absolute path of the web document root via a request for a directory that does not exist, which leaks the pathname in an error message...

PHP-Nuke 5.5 and 6.0: Path Disclosure

Product - PHP-Nuke + Version - 5.5, 6.0 other versions not tested jet + Website - http://www.phpnuke.org + Problems - Path Disclosure + Explanation: The fault happens in the file print.php, which this including in the modulos 'News' and 'AvantGo', in the same one is checked that the variable $sid...

MyABraCaDaWeb 1.0 - Full Path Disclosure

MyABraCaDaWeb 1.0 - Full Path Disclosure source: https://www.securityfocus.com/bid/7126/info MyABraCaDaWeb is reported to disclose path information in error messages when handling some invalid requests. This information could be useful in further attacks against a system hosting the software...

MyABraCaDaWeb 1.0 - Full Path Disclosure

source: https://www.securityfocus.com/bid/7126/info MyABraCaDaWeb is reported to disclose path information in error messages when handling some invalid requests. This information could be useful in further attacks against a system hosting the software. http://www.example.com/index.php?IDAdmin=tes...

Thunderstone Software TEXIS Nonexistent File Request Path Disclosure

The Thunderstone Software TEXIS application running on the remote host is affected by an information disclosure vulnerability that allows an unauthenticated, remote attacker to obtain the full path of the web root directory by making a specially crafted request for a nonexistent file. %NASLMINLEV...

ColdFusion on IIS cfm/dbm Diagnostic Error Path Disclosure

It was possible to make the remote web server disclose the physical path to its web root by requesting a MS-DOS device ending in .dbm as in nul.dbm. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script was written by Renaud Deraison Modified by Paul Johnston for Westpoint Ltd to displ...

Serv-U < 2.5e Multiple Vulnerabilities (OF, Path Disc)

The remote FTP server discloses the full path to its root through a CWD command for a nonexistent directory. In addition, the server may be prone to a buffer overflow that may allow a remote, authenticated attacker to launch a denial of service attack against the affected software. C Tenable...

PHP-Nuke 5.5/6.0 News Module - Full Path Disclosure

source: https://www.securityfocus.com/bid/7079/info The News module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker may use the information gathered in this manner to mount further attacks...

PHP-Nuke 5.56.0 AvantGo Module - Full Path Disclosure

PHP-Nuke 5.56.0 AvantGo Module - Full Path Disclosure source: https://www.securityfocus.com/bid/7078/info The AvantGo module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker may use the...

PHP-Nuke 5.5/6.0 AvantGo Module - Full Path Disclosure

source: https://www.securityfocus.com/bid/7078/info The AvantGo module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker may use the information gathered in this manner to mount further attacks...

PHP-Nuke 5.56.0 News Module - Full Path Disclosure

PHP-Nuke 5.56.0 News Module - Full Path Disclosure source: https://www.securityfocus.com/bid/7079/info The News module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker may use the information...

PHP-Nuke Splatt Forum 3.2 Module - Full Path Disclosure

PHP-Nuke Splatt Forum 3.2 Module - Full Path Disclosure source: https://www.securityfocus.com/bid/7080/info The Splatt Forum module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker could use the...

PHP-Nuke Splatt Forum 3.2 Module - Full Path Disclosure

source: https://www.securityfocus.com/bid/7080/info The Splatt Forum module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker could use the information gathered in this manner to mount further...

typo3 issues

hola, ... [email protected]/Martin Eiszner ===================== Security REPORT TYPO3 ===================== this document: http://www.websec.org/adv/typo3.html Product: Typo3 Version 3.5b5 / Earlier versions are possibly vulnerable too Vendor: Typo3 http://www.typo3.com Vendor-Status:...

typo3 issues

hola, ... [email protected]/Martin Eiszner ===================== Security REPORT TYPO3 ===================== this document: http://www.websec.org/adv/typo3.html Product: Typo3 Version 3.5b5 / Earlier versions are possibly vulnerable too Vendor: Typo3 http://www.typo3.com Vendor-Status:...

Apple QuickTime/Darwin Streaming Server Multiple Remote Vulnerabilities

The remote host is running Apple QuickTime Streaming Server. There are multiple flaws in this version : Remote code execution vulnerability by default with root privileges 2 Cross-Site Scripting vulnerabilities Path Disclosure vulnerability Arbitrary Directory listing vulnerability Buffer overflo...

XSS and Path Disclosure in Sage

=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: XSS and Path Disclosure in Sage product: Sage 1.0b3 vendor: http://sage.dev.box.sk/ risk: middle date: 02/20/2k3 discovered by: euronymous /f0kp /r00tc0de advisory urls: http://f0kp.iplus.ru/bz/015.en.txt http://f0kp.iplus.ru/bz/015.ru.txt...

Sage 1.0 Beta 3 - Content Management System Full Path Disclosure

Sage 1.0 Beta 3 - Content Management System Full Path Disclosure source: https://www.securityfocus.com/bid/6893/info Sage Content Management System contains a path disclosure vulnerability. When a request is made for a module that does not exist, the returned error message contains the full path ...

XSS and Path Disclosure in Sage

=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: XSS and Path Disclosure in Sage product: Sage 1.0b3 vendor: http://sage.dev.box.sk/ risk: middle date: 02/20/2k3 discovered by: euronymous /f0kp /r00tc0de advisory urls: http://f0kp.iplus.ru/bz/015.en.txt http://f0kp.iplus.ru/bz/015.ru.txt...