CVE-2011-3803: Exposure of Sensitive Information to an Unauthorized Actor

SugarCRM 6.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/Sugar5/layoututils.php and certain other files...

CVE-2011-3826: Exposure of Sensitive Information to an Unauthorized Actor

Zikula 1.2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/voodoodolly/version.php and certain other files...

PT-2011-4656

Name of the Vulnerable Software and Affected Versions OrangeHRM version 2.6.0.2 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is demonstrated by accessing certain files, such as themes/orange/menu/Menu.php, which reveals th...

PT-2011-4713

Name of the Vulnerable Software and Affected Versions Yamamah version 1.0 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by accessing specific files, such as "themes/default/index.php", which reveals the...

CVE-2011-3746: Exposure of Sensitive Information to an Unauthorized Actor

Jcow 4.2.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/default/page.tpl.php and certain other files...

PT-2011-4636

Name of the Vulnerable Software and Affected Versions Jcow version 4.2.1 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by accessing specific files, such as themes/default/page.tpl.php, which reveals the...

PlaySms 0.9.5.2 - Remote File Inclusion

PlaySms 0.9.5.2 - Remote File Inclusion ============================================================================================================= o PlaySMS affected all this files web/plugin/themes/default/pageforgot.php web/plugin/themes/default/pagelogin.php...

Hackers Exploiting Zero-Day in WordPress Themes

Hackers are actively exploiting a zero-day vulnerability that may be affecting millions of WordPress users. The bug was found in an image re-sizing utility that comes built-in to a number of commercial and free themes on the popular blogging platform. The vulnerability, discovered by Feedjit...

WordPress Themes Vulnerability

TimThumb, a PHP script that is reused in many popular themes for the WordPress blog software, contains a vulnerability that allows a remote attacker to upload arbitrary PHP code to an affected site. US-CERT encourages users and administrators to: determine if any hosted blogs use TimThumb by...

Argeweb SQL Injection

x Exploit Title: Argeweb SQL Ýnjection Vulnerability Deze Weblog Themes x Date: 24/07/2011 x Author: 3spi0n x HomePage: Http://Www.3spi0n.NET | Http://Twitter.Com/RigidusCO | CrypTR.ORG x E-Mail: 3spi0natgmaildotcom x Software Link: http://www.argeweb.nl/ x Category: WebApps x Google Dork: "Deze...

Mozilla Firefox Security Bypass Vulnerability (Jul 2011) - Windows

Mozilla Firefox is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

IL и XSS уязвимости во многих темах для WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Information Leakage и Cross-Site Scripting уязвимостях во многих темах для WordPress. В разных шаблонах имеется test.php - скрипт с phpinfo - что приводит к Information Leakage утечка FPD и другой важной информации о сервере и XSS в PHP 4.4.1,...

FreeBSD : drupal6 -- multiple vulnerabilities (1acf9ec5-877d-11e0-b937-001372fd0af2)

Drupal Team reports : A reflected cross site scripting vulnerability was discovered in Drupal's error handler. Drupal displays PHP errors in the messages area, and a specially crafted URL can cause malicious scripts to be injected into the message. The issue can be mitigated by disabling on-scree...

drupal6 -- multiple vulnerabilities

Drupal Team reports: A reflected cross site scripting vulnerability was discovered in Drupal's error handler. Drupal displays PHP errors in the messages area, and a specially crafted URL can cause malicious scripts to be injected into the message. The issue can be mitigated by disabling on-screen...

Fedora Update for kdeartwork FEDORA-2011-5200

Check for the Version of kdeartwork OpenVAS Vulnerability Test Fedora Update for kdeartwork FEDORA-2011-5200 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

[SECURITY] Fedora 14 Update: kdeartwork-4.6.2-1.fc14

Additional artwork for KDE, including additional styles, themes...

[SECURITY] Fedora 15 Update: kdeartwork-4.6.2-1.fc15

Additional artwork for KDE, including additional styles, themes...

TimThumb 1.24 XSS / DoS / Path Disclosure

Hello list! I want to warn you about Cross-Site Scripting, Full path disclosure, Abuse of Functionality and Denial of Service vulnerabilities in TimThumb and multiple themes for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are TimThumb and all web...

PT-2010-4723

Name of the Vulnerable Software and Affected Versions Free Simple CMS versions 1.0 and earlier Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the body, footer, header, menu left, or menu right parameter. This can be achieved by exploiting remote file...

CVE-2010-3742: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the 1 meta or 2 phpincdir parameter, a different issue than CVE-2010-3307...