Eobot: OPTIONS METHOD ENABLED

URL: https://www.eobot.com/chat/ Summary: I detected that OPTIONS method is allowed. This issue is reported as extra information. Impact: Information disclosed from this page can be used to gain additional information about the target system. Fix: Disable OPTIONS method in all production systems...

Magento Server MAGMI Plugin - Remote File Inclusion Vulnerability

Exploit for php platform in category web applications Exploit found date: 10/24/2014 Security Researcher name: Parvinder Singh Bhasin Contact info: email protected twitter: @parvinderb Currently tested version: Magento version: Magento CE - 1.8 and newer versions MAGMI version: v0.7.17a and great...

jaysonkent.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-51890 Description| Value ---|--- Affected Website:| jaysonkent.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Information disclosure

The NotreDame Seguradora aka br.com.notredame.mobile.NotreDame application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

XSS vulnerabilities in Megapolis.Portal Manager

Hello 3APA3A! These are Cross-Site Scripting vulnerabilities in Megapolis.Portal Manager. It's commercial CMS from Softline-IT earlier Softline, which in particularly widespread among Ukrainian government sites including ministry, parliament, two special services and many other web sites. In 2012...

Information disclosure

The Senator Inn & Spa aka com.conduit.appcc06e8e9659c4cf7b361ad0b7717f3a4.app application 1.2.2.160 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Localize: files likes of README.md is public

A readme or read me file contains information about other files in a directory or archive and is commonly distributed with computersoftware. Such a file is usually a text file called README.TXT, README.md, README.1ST, READ.ME, or simply README, although someMicrosoft Windows software may...

Ultra Electronics 7.2.0.19 and 7.4.0.7 - Multiple Vulnerabilities

No description provided by source. Ultra Electronics / AEP Networks - SSL VPN Netilla / Series A / Ultra Protect Vulnerabilities http://www.osisecurity.com.au/advisories/ultra-aep-netilla-vulnerabilities Release Date: 02-Oct-2014 Software: Ultra Electronics - Series A...

Information disclosure

The MemorizeIt! aka com.kshinenterprises.kshinent.memorizeit application 1.7.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

WordPress Content Audit 1.6 Blind SQL Injection Vulnerability

WordPress Content Audit plugin version 1.6 suffers from a remote SQL injection vulnerability. Details ================ Software: Content Audit Version: 1.6 Homepage: http://wordpress.org/plugins/content-audit/ Advisory report:...

Bash Environment Variable Command Execution

Date: Wed, 24 Sep 2014 17:03:19 +0200 From: Florian Weimer To: [email protected] Subject: Re: CVE-2014-6271: remote code execution through bash Florian Weimer: Chet Ramey, the GNU bash upstream maintainer, will soon release official upstream patches...

SA-CONTRIB-2014-093 - Twilio - Information Disclosure

This module enables you to easily add SMS and VOIP functionality to your website by leveraging the Twilio cloud Voip and SMS service. The module doesn't expose its own permissions for administration including viewing and editing the Twilio authentication tokens. It relies only on "access...

Information disclosure

The Zombie Detector aka com.jimmybolstad.zombiedetector application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The gewara aka com.gewara application 5.2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Guess The Movie aka com.june.guessthemovie application 2.982 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Wordpress Video Gallery Plugin 2.5 - Multiple Vulnerabilities

No description provided by source. Wordpress Video Gallery Exploit Title : Wordpress Video Gallery 2.5 SQL Injection and XSS Vulnerabilities Exploit Author : Claudio Viviani Vendor Homepage : http://www.apptha.com/category/extension/Wordpress/Video-Gallery Software Link :...

UniFi / mFi / AirVision Cross Site Request Forgery

----------- Vendor: ----------- Ubiquiti Networks http://www.ubnt.com/ ----------------------------------------- Affected Products/Versions: ----------------------------------------- UniFi Controller v2.4.6 mFi Controller v2.0.15 AirVision Controller v2.1.3 Note: Previous versions may be affected...

WordPress DZS Video Gallery XSS / Path Disclosure / Command Execution

Hello list! These are Cross-Site Scripting, Full path disclosure and OS Commanding vulnerabilities in plugin DZS Video Gallery for WordPress. Earlier I've disclosed Content Spoofing and Cross-Site Scripting vulnerabilities in this plugin http://securityvulns.ru/docs30871.html...

Invision Power Board <= 3.3.4 unserialize Regex Bypass

No description provided by source. ?php / So this is the patch that sanitizes, static public function safeUnserialize $serialized // unserialize will return false for object declared with small cap o // as well as if there is any ws between O and : if isstring $serialized && strpos $serialized, \...

PHP <=5.3 - preg_match() full path disclosure

No description provided by source. MajorSecurity Advisory 57PHP =5.3 - pregmatch full path disclosure Details ======= Product: PHP =5.3 Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.php.net/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered b...