Uzbey: Language version disclosure in response header

go to https://staging.uzbey.com/ in google chrome browser 2. Right click mouse and choose inspect element options 3. click network and choose request and response for staging.uzbey.com Remote Address:54.200.82.121:443 Request URL:https://staging.uzbey.com/ Request Method:GET Status Code:200 OK...

Skybox Security 6.3.x < 6.4.x - Multiple Information Disclosures

Exploit Title: SKYBOX Security – Multiple Information Disclosure Date: 22-Jan-2014 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.skyboxsecurity.com Version: Skybox View Appliances with ISO versions: 6.3.33-2.14, 6.3.31-2.14, 6.4.42-2.54, 6.4.45-2.56, 6.4.46-2.57 Tested on: Centos 6.4...

Khan Academy: Lighttpd version disclosure / directory listing

Hello there, the website at http://graphite.khanacademy.org/ isn't configured correctly. It displays the lighttpd version as well the directory contents. You should disable these features in your lighttpd.conf / php.ini. PoC: Index of / Name Last Modified Size Type Parent Directory/ - Directory...

Concrete CMS: page_controls_menu_js can reveal collection version of page

By visiting the url /tools/required/pagecontrolsmenujs?cID=&cvID= Where cID = page cID and cvID is unknown, If for cvID you start at 1 and the currently approved version is not the first version the code $function ccmAlert.hud'This page is pending approval.', 5000; ; is added to the header. If th...

[Netsparker v3.0.2.0 Community Edition] Web Application Security Scanner

Netsparker can crawl, attack and identify vulnerabilities in all custom web applications regardless of the platform and the technology they are built on, just like an actual attacker. It can identify web application vulnerabilities like SQL Injection, Cross-site Scripting XSS, Remote Code Executi...

CVE-2013-0519

IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 provides web-server version data in 1 an unspecified page title and 2 an unspecified HTTP header field, which allows remote attackers to obtain potentially...

Information disclosure

IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 provides web-server version data in 1 an unspecified page title and 2 an unspecified HTTP header field, which allows remote attackers to obtain potentially...

CVE-2013-0519

CVE-2013-0519 affects IBM Sterling Secure Proxy 3.2.0, 3.3.01 before 3.3.01.23 iFix 1, 3.4.0 before 3.4.0.6 iFix 1, and 3.4.1 before 3.4.1.7, where the web-server version is disclosed in (1) an unspecified page title and (2) an HTTP header, enabling remote disclosure of a version string. IBM reme...

PT-2013-07: Path and Version Disclosure in Oracle Siebel CRM

The specialists of the Positive Research center have detected a Path and Version Disclosure vulnerability in Oracle Siebel CRM. An attacker is able to disclose software path and version if he imports an invalid XML file. How to fix Update your software up to the latest version Advisory status...

WordPress plugin Foxypress uploadify.php Arbitrary Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'WordPress plugin Foxypress...

nginx < 1.0.14 / 1.1.x < 1.1.17 Information-Disclosure

Binary data 6457.prm...

op5 Monitor Credential Leak

The version of op5 Monitor hosted on the remote web server contains an information disclosure vulnerability. In the default configuration, detailed error messages are enabled. An authenticated user, upon triggering an error, will be presented with sensitive data including database credentials, th...

Cisco IOS Common Network Service Remote Version Disclosure

The remote Cisco device is potentially affected by an unspecified vulnerability involving a 'common network service' that may allow a remote attacker to determine the IOS version. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17777; scriptversion"1.5";...

phpThumb 1.7.9 Information Disclosure

Exploit Title: phpThumb 'phpThumbDebug' Information Disclosure Google Dork: inurl:phpThumb.php Date: 06/05/2011 Author: mook Software Link: http://phpthumb.sourceforge.net/download Version: 1.7.9 Tested on: linux Vulnerability: Information disclosure which includes absolute system paths, os...

Kunena SQL Injection Vulnerability &amp; Information Leakage

Vendor/Product: Kunena Vulnerable Versions: 1.5.14; 1.6.3 Vulnerability Type: SQL Injection & information leakage Risk level: High Vulnerability Details: Because parameterized queries were not used, and adequate input sanitization was not done on the catids parameter on the advanced search page, ...

Kunena 1.5.13 1.6.3 - SQL Injection

Kunena 1.5.13 1.6.3 - SQL Injection Vendor/Product: Kunena Vulnerable Versions: 1.5.14; 1.6.3 Vulnerability Type: SQL Injection & information leakage Risk level: High Vulnerability Details: Because parameterized queries were not used, and adequate input sanitization was not done on the catids...

Kunena SQL Injection

Vendor/Product: Kunena Vulnerable Versions: 1.5.14; 1.6.3 Vulnerability Type: SQL Injection & information leakage Risk level: High Vulnerability Details: Because parameterized queries were not used, and adequate input sanitization was not done on the catids parameter on the advanced search page, ...

[Security] nessusd_www_server.nbin cross site scripting and version disclosure

Jul 26, 2010 3:33 PM Security nessusdwwwserver.nbin cross site scripting and version disclosure Issues Description The Nessus Web Server nessusdwwwserver.nbin was vulnerable to the following two issues: 1. Cross Site Scripting Vulnerability The Nessus Web Server was vulnerable to a cross site...

CVE-2009-4943

index.php in AdPeeps 8.5d1 allows remote attackers to obtain sensitive information via 1 a viewadrates action with an invalid uid parameter, which reveals the installation path in an error message; or 2 an adminlogin action with a crafted uid parameter, which reveals the version number...

Version number

I notice that the JIRA footer displays the current version of JIRA. Revealing the specifics of the revisions of software that you run in production is generally considered a bad security practice. Is there a reason that it is displayed openly to all users in licensed versions of the product? Is i...