CVE-2015-8859

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors...

CVE-2015-8859

CVE-2015-8859 concerns the Node.js send package prior to 0.11.1, where an information leakage/root path disclosure vulnerability exists via unspecified vectors. Connected sources (GHSA-... and OSV entries) confirm this vulnerability, with remediation advised to upgrade to 0.11.1 or later. Affecte...

CVE-2015-8859

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors...

CVE-2015-8859

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors...

CVE-2015-8859: Undefined Security Weakness

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors...

CVE-2016-6802

Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path...

PT-2017-7491 · Send +1 · Send +1

Name of the Vulnerable Software and Affected Versions: send versions prior to 0.11.1 Description: The issue allows attackers to obtain the root path via unspecified vectors, potentially enabling them to enumerate paths on the server filesystem. Recommendations: For versions prior to 0.11.1, updat...

GEOVAP Reliance 4 Control Server Privilege Escalation Vulnerability

GEOVAP Reliance 4 Control Server suffers from an unquoted search path issue impacting the service 'RelianceOpcDaWrapper' for Windows deployed as part of Reliance 4 SCADA/HMI system installer including Reliance OPC Server. This could potentially allow an authorized but non-privileged local user to...

用友某系统从弱口令到sql注射到getshell

简要描述： 弱口令、sql注射、getshell 详细说明： 系统地址： http://vip.ufida.com.cn/Frame/Index.aspx 弱口令帐号：adminnc 密码：adminnc 在自助查询处，发现注入（需要登录，注意cookie有时效） GET http://vip.ufida.com.cn/RepositorySearchInfo/DoctInfo.aspx?ReposID=38d4a08e-8b79-4de7-8566-30aecfb1d56f HTTP/1.1 Accept: text/html, application/xhtml+xml, /...

ManageEngine Password Manager MetadataServlet.dat SQL Injection Exploit

This Metasploit module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet, which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and Password Manager Pro v6 build 6500 to v7 build 7002 including the MSP versions. The SQL injection can be used to...

Brightstation Muscat 1.0 Root Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2374/info Making an invalid request to a machine running Brightstation Muscat, will disclose the physical path to the root directory. http://target/cgi-bin/empower?DB=UkRteamHole http://target/cgi-bin/empower?DB=UkRteamHo...

SAPID Shop <= 1.2 (root_path) Remote File Include Vulnerability

No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register class TestPOCPOCBase: vulID = '63795' ssvid version = '1.0' author = '皮皮' vulDate = '2006-08-09' createDate = '2015-12-24...

Captaris Infinite Mobile Delivery Webmail 2.6 Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12399/info Infinite Mobile Delivery Webmail is reportedly affected by a path disclosure vulnerability. This issue could permit a malicious user to expose the root path of the affected application...

ManageEngine Desktop Central / Password Manager LinkViewFetchServlet.dat SQL Injection

This module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet, which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and Password Manager Pro v6 build 6500 to v7 build 7002 including the MSP versions. The SQL injection can be used to achieve remot...

UBUNTU-CVE-2013-6456

The LXC driver lxc/lxcdriver.c in libvirt 1.0.1 through 1.2.1 allows local users to 1 delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; 2 create arbitrary nodes mknod via the virDomainDeviceAttach API and a symlink attack on /dev in th...

PT-2012-5892

Name of the Vulnerable Software and Affected Versions SAPID CMS version 1.2.3 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via a URL in the root path parameter to specific API endpoints, such as "usr/extensions/get tree.inc.php" or...

Paliz CMS Full Path Disclosure Vulnerability

Title: Paliz CMS Full Path Disclosure Vulnerability Vulnerable Version: all versions Vendor URL: http://palizct.com Impact: Low =========================== Vulnerability Description: =========================== Full Path Disclosure Vulnerability, enable the attacker to see the root path...

Apache Tomcat Examples Web Root Path Disclosure

The instance of Apache Tomcat listening on the remote host is affected by an information disclosure vulnerability. An attacker is able to determine the Tomcat application's web root path by requesting any one of numerous example files. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

IIS 5.0 PERL IISAPI扩展列举服务器根路径

No description provided by source...

Piwigo v2.0.6 Multiple Vulnerabilities

Exploit for unknown platform in category web applications ========================================= Piwigo : mysqlfetcharray expects parameter 1 to be resource, boolean given in C:\xampp\htdocs\piwigo-2.0.6\include\functions.inc.php on line 936 The parentid and imageid and unsanitized however...