346 matches found
Camper-PRO - Motorhome - Dynamic Code Loading, External URLs, SD-card access vulnerabilities
HackApp vulnerability scanner discovered that application Camper-PRO - Motorhome published at the 'play' market has multiple vulnerabilities...
Coinbase: Direct URL access to completed reports
Access to non-HTML contents such as CSV report is not restricted to authenticated users. Anyone would be able to access a CSV report by giving the direct URL and downloading it. The URL could be obtained from browser history. The following URL is an example...
Google Chrome Extended URL Checksum Arbitrary URL Access Vulnerability
Google Chrome is a WEB-based browser. The RuntimeEventRouter::OnExtensionUninstalled function in Google Chrome extensions/browser/api/runtime/runtimeapi.cc checksums URLs for a security vulnerability that allows remote attackers to construct malicious WEB pages that can be accessed at arbitrary...
Fiyo CMS Direct URL Access Vulnerability
Fiyo CMS is small business phone service and mobile collaboration tool. A direct URL access vulnerability exists in Fiyo CMS. An attacker could exploit the vulnerability to perform unauthorized actions...
Microsoft IIS URL Access Violation DoS - Ver2 (CVE-2002-0072)
A denial-of-service vulnerability has been reported in Microsoft IIS. Successful exploitation of this vulnerability would allow a remote attacker to create a denial of service condition on the affected system...
Design/Logic Flaw
Google Chrome before 39.0.2171.65 on Android does not prevent navigation to a URL in cases where an intent for the URL lacks CATEGORYBROWSABLE, which allows remote attackers to bypass intended access restrictions via a crafted web site...
WordPress 2.9 - Failure to Restrict URL Access
...
WordPress 2.9 - Failure to Restrict URL Access
Description When WordPress implemented the new Trash feature they failed to change the permissions granted when the post is in the trash. This means that an unauthenticated user cannot see the post, however an authenticated user can, no matter what privileges they have, even ‘subscriber’. See...
CVE-2014-1369
WebKit in Apple Safari before 6.1.5 and 7.x before 7.0.5 allows user-assisted remote attackers to access file: URLs by leveraging a URL drag operation that originates at a crafted web site...
eLineStudio Site Composer (ESC) <= 2.6 - Multiple Vulnerabilities
No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: eLineStudio Site Composer ESC =2.6 Multiple Vulnerabilities Vendor: www.elinestudio.com Vulnerable Version: 2.6 and prior versions Exploit: Available Impact: High Fix: N/A Original Advisory:...
quickersite 1.8.5 - Multiple Vulnerabilities
No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: QuickerSite Multiple Vulnerabilities Vendor: www.quickersite.com Vulnerable Version: 1.8.5 Exploit: Available Impact: High Fix: N/A Original Advisory: http://bugreport.ir/index.php?/39 1. Description:...
WordPress 2.9 - Failure to Restrict URL Access
No description provided by source. WordPress = 2.9 Failure to Restrict URL Access http://www.thomasmackenzie.co.uk/ 1. Advisory Information Title: WordPress = 2.9 Failure to Restrict URL Access Date published: 2. Vulnerability Information Class: Failure to Restrict URL Access Remotely Exploitable...
OneFileCMS - Failure to Restrict URL Access
No description provided by source. Exploit Title: OneFileCMS - Failure to Restrict URL Access Date: 12th March 2012 Author: Abhi M Balakrishnan Software Link: https://raw.github.com/rocktronica/OneFileCMS/f265961d0646890c9efe05b93983124abc18c56e/onefilecms.php Version: upto 1.1.4 Tested on:...
Yahoo!: Information Disclosure, groups.yahoo.com,6-april-2014, #SpringClean
Thank you for your submission to Yahoo’s Bug Bounty program. While we recognize the effort that you put into the research and writing of a report for us to evaluate, but unfortunately this bug is already known to us. We appreciate your adherence to responsible disclosure guidelines and look forwa...
SA-CONTRIB-2013-073 - Make Meeting Scheduler - Access Bypass
This module enables you to create polls accessible by an url with hash e.g. example.com/makemeeting/sn9028xh3398 so that anonymous users can view and vote on the poll. The module didn't sufficiently check access when a poll is accessed directly via its node url e.g. node/123. Note: a user with th...
[Full-disclosure] Magnolia CMS multiple access control vulnerabilities
Subject: ====== Multiple access control vulnerabilities in Magnolia CMS, Community and Enterprise editions CVE ID: ====== CVE-2013-4621 Summary: ======== A non-admin user such as default users eric / peter can access and execute multiple administrative functionalities of the CMS by accessing...
chillyCMS 1.3.0 - Multiple Vulnerabilities
Exploit for php platform in category web applications Vulnerability Failure to Restrict URL Access chillyCMS uses 302 redirects to restrict access to the unautorized pages. Exploit Step 1: Create a rule in No-Redirect Add-on: ^http://localhost/chillyCMS/ Step 2: Access...
ChillyCMS 1.3.0 - Multiple Vulnerabilities
Exploit Title: chillyCMS 1.3.0 Multiple Vulnerabilities Google Dork: "powered by chillyCMS" Date: 15 February 2013 Exploit Author: Abhi M Balakrishnan Vendor Homepage: http://chillycms.bplaced.net/ Software Link: http://chillycms.bplaced.net/chillyCMS/media/files/chillyCMSfull.zip Version: 1.3.0...
OneFileCMS - Failure to Restrict URL Access
OneFileCMS - Failure to Restrict URL Access Exploit Title: OneFileCMS - Failure to Restrict URL Access Date: 12th March 2012 Author: Abhi M Balakrishnan Software Link: https://raw.github.com/rocktronica/OneFileCMS/f265961d0646890c9efe05b93983124abc18c56e/onefilecms.php Version: upto 1.1.4 Tested...
OneFileCMS - Failure to Restrict URL Access
Exploit Title: OneFileCMS - Failure to Restrict URL Access Date: 12th March 2012 Author: Abhi M Balakrishnan Software Link: https://raw.github.com/rocktronica/OneFileCMS/f265961d0646890c9efe05b93983124abc18c56e/onefilecms.php Version: upto 1.1.4 Tested on: Apache-2.2.17, PHP-5.2.17, MySQL-5.5.9,...