CVE-2011-3710: Exposure of Sensitive Information to an Unauthorized Actor

bbPress 1.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by bb-templates/kakumei/view.php and certain other files...

PT-2011-4600

Name of the Vulnerable Software and Affected Versions bbPress version 1.0.2 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by accessing specific files, such as 'bb-templates/kakumei/view.php', which reveals the...

PT-2011-4628

Name of the Vulnerable Software and Affected Versions Feng Office version 1.7.2 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by accessing specific files, such as public/upgrade/templates/layout.php, which revea...

PT-2011-4629

Name of the Vulnerable Software and Affected Versions Freeway version 1.5 Alpha Description The issue allows remote attackers to obtain sensitive information via a direct request to certain .php files. This is demonstrated by files such as templates/Freeway/boxes/last product.php, which reveals t...

PT-2011-4635

Name of the Vulnerable Software and Affected Versions HycusCMS version 1.0.3 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by accessing the file directly, which reveals the installation path in an error message...

PT-2011-4603

Name of the Vulnerable Software and Affected Versions cFTP version r80 Description The issue allows remote attackers to obtain sensitive information via a direct request to certain .php files. This is demonstrated by files such as templates/session check.php, which reveals the installation path i...

CVE-2011-3488

The CVE affects Equis MetaStock 11 and earlier, where a use-after-free in the parser for four UI components (mwc chart, mws chart, mwt template, mwl layout) can allow remote code execution. Root cause is a use-after-free condition in handling these malformed inputs; no exploitation details are pr...

CVE-2011-2889: Exposure of Sensitive Information to an Unauthorized Actor

templates/system/error.php in Joomla! before 1.5.23 might allow remote attackers to obtain sensitive information via unspecified vectors that trigger an undefined value of a certain error field, leading to disclosure of the installation path. NOTE: this might overlap CVE-2011-2488...

phpBB AJAX Chat/Shoutbox MOD CSRF Vulnerability

No description provided by source. Title: phpBB AJAX Chat/Shoutbox MOD CSRF Vulnerability Release Date: 2011-04-30 Product Affected: http://startrekaccess.com/community/viewtopic.php?f=127&t=8675 Responsible Disclosure: After repeated attempts to get the vendor to fix this flaw, he has told me to...

Set sail for the enterprise built Station system cookie injection vulnerability-vulnerability warning-the black bar safety net

Sail mechanical and electrical equipment enterprise built Station system, The system do businesses stand dynamic templates, code interface separation, is a set of website user with no technical threshold, simple operation, convenient maintenance, powerful, secure and reliable website tool. Websit...

How to back up VM templates

Purpose This article serves as a quick reference for information about backing up vSphere Templates. Solution To be able to select a template in the list of virtual infrastructure objects when adding objects to a Backup job, select the VMs and Templates view from the top-right view options. When...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in component handlers in the javatemplates aka Java Templates plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of...

CVE-2011-2087

Multiple cross-site scripting XSS vulnerabilities in component handlers in the javatemplates aka Java Templates plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of...

W78 enterprise website backstage management system ewebeditor5. 5 exploit-vulnerability warning-the black bar safety net

w78CMS enterprise website management system is a set designed for enterprise users to tailor the ASP CMS open source systems While providing a variety of page templates,business website templates,free enterprise web systems,automatic establishment of the station system,all-round business...

Уязвимости в TimThumb и во многих темах для WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, Full path disclosure, Abuse of Functionality и Denial of Service уязвимостях в TimThumb и во многих темах для WordPress. Уязвимыми являются TimThumb и все веб приложения в частности темы для WordPress, которые его используют...

Уязвимости в темах Live Wire 2.0 и Live Wire Style для WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, Full path disclosure, Abuse of Functionality и Denial of Service уязвимостях в темах Live Wire 2.0 и Live Wire Style для WordPress. Это ещё две темы, которые вместе с Live Wire Edition входят в серию Live Wire. Это коммерческ...

[SECURITY] Fedora 15 Update: rubygem-rails-3.0.5-2.fc15

Rails is a framework for building web-application using CGI, FCGI, modruby, or WEBrick on top of either MySQL, PostgreSQL, SQLite, DB2, SQL Server, or Oracle with eRuby- or Builder-based templates...

HP MFP Digital Sending Software 4.91.0 Local Authentication Bypass

The remote Windows host contains HP MFP Digital Sending Software version 4.91.0. This version is potentially affected by an authentication bypass vulnerability related to device configuration templates. A local attacker, exploiting this flaw, reportedly can gain unauthorized access to functionali...

CVE-2011-0279

HP Multifunction Peripheral MFP Digital Sending Software DSS 4.91.00 does not properly configure authentication settings of managed devices within device templates, which allows attackers to access these devices via actions that were intended to require authentication...

Authentication flaw

HP Multifunction Peripheral MFP Digital Sending Software DSS 4.91.00 does not properly configure authentication settings of managed devices within device templates, which allows attackers to access these devices via actions that were intended to require authentication...